Is 402 Payment Required an official status?
It is registered by IANA but reserved for future use, with no standard meaning. Services that send it define their own behaviour, usually tied to billing.
HTTP 402 PAYMENT REQUIRED
Reserved for future use. Some APIs use it for billing limits. 402 belongs to the 4xx client error class and is defined in RFC 9110.
Loading the workbench.
About HTTP 402
What Does HTTP 402 Payment Required Mean?
Reserved for future use. Some APIs use it for billing limits. The code is registered with IANA and defined in RFC 9110.
Client error: the request has a problem, so it cannot be fulfilled as sent. Every code from 400 to 499 shares that general meaning, so a client that does not recognise 402 must treat it like 400.
When Do You See a 402 Response?
402 Payment Required has been reserved since the early days of HTTP for digital payment schemes that never materialised, so it has no standard semantics. Some services use it anyway: APIs return it when a subscription has lapsed, a prepaid quota is exhausted, or a card was declined, and some platforms use it to block a site whose account is unpaid. Because the meaning is not standardised, clients cannot rely on any particular body format.
How Do You Fix a 402?
Clients should treat 402 as a billing problem and read the body for details such as a link to update payment information; retrying will not help until the account is fixed. Servers using it should document the meaning and include a machine-readable error body. If the limit is about request rate rather than money, 429 is the standard code, and for permission problems 403 is clearer.
What Does a 402 Response Look Like?
HTTP/1.1 402 Payment Required
Content-Type: application/json
Link: <https://example.com/billing>; rel="payment"402 is not cacheable by default: a browser or CDN stores it only when Cache-Control or Expires explicitly allows it.
To inspect a real one without sending it anywhere:
- Copy the response headers from your browser Network tab, or from
curl -i. - Paste them into the Header decoder to see every header explained.
- Check caching in the Cache lane.
Which Status Codes Are Related to 402?
- 403 Forbidden: The server knows who you are and refuses anyway. Logging in again will not help.
- 429 Too Many Requests: Rate limited. Retry-After says when to try again.
- 401 Unauthorized: Authentication is missing or failed. Must send WWW-Authenticate. Really means "unauthenticated".
Browse every code on the HTTP status codes page.
What Other Lanes Are in the Reference Section?
- HTTP status codes: Every IANA-registered status code, with a page per code.
- MIME types: File extensions to Content-Type, searchable both ways, plus a Content-Type parser.
- HTTP methods: GET, POST, PUT, PATCH, DELETE and the rest: safe, idempotent, cacheable.
Elsewhere in 2http: Header decoder, Cookie decoder, Cache-Control decoder, CORS checker, User-agent parser, and all eleven lanes on the 2http home page. Part of the 2suite.io privacy-first ecosystem.
Frequently Asked Questions
Should my API return 402 or 429 when a quota is used up?
Use 429 for temporary rate limits that reset over time. Some APIs use 402 when the only fix is paying or upgrading the plan.
Is HTTP 402 an error?
Yes. 402 is a client error response: the problem is in the request, so repeating it unchanged will usually fail again.
Is a 402 response cacheable by default?
No. Caches store a 402 only when Cache-Control or Expires explicitly allows it.
How Can You Verify That Nothing Leaves This Browser?
You do not have to take our word that your headers stay here. Developer tools show every request a page makes, so you can watch this page work and confirm that nothing is sent. The check takes under a minute.
- Open your browser developer tools with
F12, orCmd+Option+Ion a Mac, and select the Network tab. - Reload the page and let it finish. You will see the page's own files, its web fonts, and one anonymous page-view request. Nothing has been typed yet, so none of them can contain your headers.
- Click the clear icon in the Network tab so that the log is empty.
- Paste real headers into any lane and read the result.
- Look at the Network tab again. It is still empty. For extra proof, turn on offline mode after the page loads and every lane keeps working.
Only two things can add a line to that log, and neither carries your headers. Submitting the feedback form sends the vote and comment you typed. Typing characters in a script the page has not displayed yet, such as Cyrillic or Greek, can make the browser fetch the matching font file, and that request names only the font.
2http never sends a request on your behalf: the request builder writes code for you to run, and the meta inspector reads source you paste instead of fetching a URL. The production site also sends a Content-Security-Policy header that tells your browser to refuse connections to anywhere except this site and the anonymous analytics endpoint.