x402—Making HTTP 402 Actually Payable
A status code unused for decades now charges for API calls. Which cost does machine payment change?
Checked in September 2026. This is event-layer content; read “Expiring Details” at the end first.
What Happened
| Date | Event |
|---|---|
| Early HTTP | Status code 402, “Payment Required,” was reserved without a standard use |
| May 2025 | A major Crypto trading platform open-sourced x402. Servers return 402 and payment requirements; clients pay in stablecoins and retry with payment evidence |
| Late 2025 | Infrastructure companies announced support, and per-call APIs for AI agents appeared |
Analyze with Course Models
Chapter 35's Question in Practice
Chapter 35 asks how machines pay for one API call. Its cases include a status code left empty for decades. x402 is one way to fill it.
Four steps:
- Request
- Receive 402 and payment requirements
- Pay onchain
- Retry with evidence and receive result
Which Cost Changes?
Chapter 35 distinguishes subscription, prepayment, individual onchain payments, and metering with batch settlement. x402 chooses individual payments, reducing the cost of establishing a payment relationship. An agent visiting an API for the first time needs no person to register, attach a card, or sign agreements, as Chapter 33's software-without-ID problem explains.
It does not reduce each payment's settlement cost. It therefore depends on sufficiently cheap stablecoin transfers and fast settlement. High-frequency calls may still favor Chapter 35's metering and batching.
Who Bears the Risk?
Apply Chapter 34: where are the fuses before handing a wallet to automatic payment software?
- Limits: per payment, day, and recipient.
- Allowlist: approved services only.
- Revocable session keys, rather than the master key.
An autonomous payer's common loss is being induced to pay for something it should not, through prompt injection plus a plausible 402 (T33, T34).
Retain the Mechanism
- Embedding payment in a protocol initially lowers the cost of starting to pay, rather than each transaction's cost.
- Finer payment granularity makes limits and allowlists more important. Nobody approves a million calls individually.
- Machine payment has a different threat model: text can persuade software, rather than tricking it into clicking a link.
The Eighteen Questions
It must pay and prove payment without human involvement. Traditional approaches require someone to open an account first.
Allowlisted services only, per-payment and daily limits, and immediately revocable keys. Smaller permissions bound losses more tightly.
Induced payments are already settled onchain and cannot be recovered. The person setting fuses determines the loss boundary beforehand.
Verify Independently
Find the original specification and list fields in a 402 response: amount, currency, recipient, and expiration.
Draw a sequence diagram covering client, server, chain, and the intermediary verifying payment.
Mark three fuse locations and compare Chapter 34's checklist.
Expiring Details
- Versions, supported chains and currencies, and participating companies change rapidly.
- Competing machine-payment approaches exist; the eventual standard is undecided. Chapter 35's standard-adoption discussion explains this process.
Stablecoin Legislation—Reserve Rules Become Law
When reserve contents become legal requirements instead of issuer promises, which risks shrink and which grow?
The October 2025 Liquidation Cascade
Leveraged positions collapsed across the market in one night. What roles did prices, oracles, and automatic deleveraging play?