Skip to main content
HTTP 402 is the status code every browser has known about and nobody has ever seen. It was reserved in the original HTTP spec as “Payment Required” and left without a defined body, waiting for someone to give it a wire format. x402 is that wire format.

​
The exchange, minimally

  1. Client requests a resource with no proof of payment.
  2. Server responds 402 Payment Required with a PaymentRequired header describing what is owed.
  3. Client reads the header, signs a payment authorization, and retries with an X-Payment header.
  4. Server hands the payload to a facilitator to verify (and later settle) the payment.
  5. Server returns the resource.
That is the whole protocol. Everything else in these docs, schemes, discovery, MCP tools, is refinement on top of it.

​
The 402 response

The PaymentRequired header is a base64-encoded JSON object. Its full schema is documented in the API reference, but the fields you care about are:

​
The retry

The X-Payment payload carries the signed authorization entries and identifies the client. See PaymentPayload.

​
What 402 is not

  • Not authentication. A 402 says “you have not paid,” not “we do not know who you are.” It is compatible with API keys and OAuth, but does not replace them.
  • Not rate limiting. Rate limits use 429. If your server wants to slow a paid caller down, return 429, not 402.
  • Not a redirect. The client is expected to retry the same request against the same URL with an X-Payment header, not follow a Location.

​
Where next