What is 402 Payment Required and what happens when an agent asks without paying?

402 Payment Required is the HTTP response that says "this costs money, pay first". It sat reserved with no defined use since the early web standards, and today x402 and MPP use it so an AI agent can pay for a resource with no account or API key. If an agent asks for something priced without paying, it gets the 402 with the price and the payment options, and nothing else: the content only goes out when it repeats the request with a valid payment.

Updated: November 2026

According to MDN, 402 is still a nonstandard code "reserved for future use", and browsers display it as a generic 4xx error. That is why a 402 is useful to an agent and not to a person browsing.

Why did it go unused for so many years?

The authors of HTTP reserved it with digital cash and micropayments in mind, but never defined how payment would work. With no common format, each site charged through its own checkout and its own sign-up, and the 402 stayed empty. AI agents changed that, because an agent cannot fill in a card form, but it can read a price in a header and sign a payment with a wallet.

How do x402 and MPP use it today?

Both follow the same cycle:

1. The agent requests the resource.
2. The site answers 402 with the price, the currency and where the payment goes.
3. The agent pays and repeats the request with proof of payment.
4. The site verifies the payment and delivers the resource with a receipt.

The difference is in the headers. MPP puts each offer in WWW-Authenticate: Payment and the agent comes back with Authorization: Payment, while x402 uses PAYMENT-REQUIRED and the agent comes back with PAYMENT-SIGNATURE. We compare them in x402 vs MPP, and MPP has its own guide in what is MPP.

What does an agent get when it arrives without paying?

With Peaje, a priced route or link answers like this (values trimmed):

HTTP/2 402
content-type: application/problem+json
cache-control: no-store
www-authenticate: Payment id="…", realm="…", method="evm", intent="charge", request="…", expires="…"
www-authenticate: Payment id="…", realm="…", method="tempo", intent="charge", request="…", expires="…"
payment-required: …

{"type":"https://paymentauth.org/problems/payment-required","title":"Payment Required","status":402,"detail":"Payment is required (Report 2026).", …}

• There is one WWW-Authenticate offer per network: USDC on Arbitrum and pathUSD on Tempo.
• payment-required carries the Arbitrum offer in x402 format.
• Each offer expires after 5 minutes, and cache-control: no-store keeps intermediaries from storing the response.
• The body explains in text what is missing, for an agent that cannot read payment headers.

The content never goes out: without a payment, the agent is left with the 402.

What if the payment fails or my site goes down?

There are cases where the answer is not a 402:

When the payment goes through, the agent gets a 200 with the content and a receipt in the Payment-Receipt header, with the network and the transaction.

How do I know whether agents pay after the 402?

In Peaje, the "Agent visits" page has a "Payment funnel" with three numbers: the 402s served, how many agents came back with a payment and how many paid. If almost none come back, the agent most likely did not understand the offer, because of a confusing description or a header it cannot read. If they come back with a payment that does not complete, check the network and the currency you offer, since the agent already understood the price. Priced routes are free on every plan, and Peaje keeps 2% of each payment, according to the pricing page.

Sources

• MDN: 402 Payment Required
• RFC 9110: HTTP Semantics, 402
• x402
• mpp.dev: protocol overview
• Peaje pricing