The Problem

You built an API. You want to charge per request. Your options:

API keys + billing system — weeks of auth code, Stripe integration, chargeback risk

Subscriptions — friction for new users, overkill for occasional callers

OAuth — identity, not payment; still need billing on top

What if a client could pay for exactly one call, right now, from anywhere in the world, with cryptographic proof — and your API verified it in 10 lines of code?

HTTP 402: The Payment Required Protocol

RFC 2616 reserved status code 402 "for future use." That future is now.

The L402 protocol (built on top of HTTP 402) works like this:

Client → GET /premium Server ← 402 Payment Required WWW-Authenticate: L402 macaroon="...", invoice="lnbc10n1..."

Client pays Lightning invoice (via wallet or automated agent) Client → GET /premium Authorization: L402 <macaroon>:<preimage> Server verifies: SHA256(preimage) == paymentHash ✓ Server ← 200 OK (response)

Enter fullscreen mode

Exit fullscreen mode

The cryptographic…