[httpapi] Re: x402
Rahul Gupta <cxres@protonmail.com> Sun, 30 August 2026 16:33 UTC
Return-Path: <cxres@protonmail.com>
X-Original-To: httpapi@mail2.ietf.org
Delivered-To: httpapi@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id B6F1B131D9C16 for <httpapi@mail2.ietf.org>; Sun, 30 Aug 2026 09:33:54 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1788107634; bh=Nl/MTYJo7VBaHy7ZgCuAMUa4wKCAVcgOredngI4q7fk=; h=Date:To:From:Subject:In-Reply-To:References; b=jBclXJ3ChNir5zXsdRIYEkUCdYhcmWrIKcV+GTLCoSmF/3WvQLa4FMkD6vzcBX6Xe FECuM181Vg6iCYyrJQHhYEdEvXeFE/D8JqYO8iZ5URgXsiALG/NMorsSSuF5x+sjKx M/MwQnQdIC9dwBLZ4nkUM7Sy+Rjk2NuDY0v2S5+0=
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -0.797
X-Spam-Level:
X-Spam-Status: No, score=-0.797 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, PDS_OTHER_BAD_TLD=1.999, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H5=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=protonmail.com
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id exi1iIVefelk for <httpapi@mail2.ietf.org>; Sun, 30 Aug 2026 09:33:54 -0700 (PDT)
Received: from mail-4325.protonmail.ch (mail-4325.protonmail.ch [185.70.43.25]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 141DE131D9C0C for <httpapi@ietf.org>; Sun, 30 Aug 2026 09:33:54 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=protonmail.com; s=protonmail3; t=1788107627; x=1788366827; bh=bPzNs0skapDT1hdcZ9Rbz6r3TNqq97dUTSjuEZSX/oI=; h=Date:To:From:Subject:Message-ID:In-Reply-To:References: Feedback-ID:From:To:Cc:Date:Subject:Reply-To:Feedback-ID: Message-ID:BIMI-Selector; b=MaOlNcDDbcDyWeEHsGOj6MWnkM3OxX35h5Nsyu71finw+oi3bdz/kU2A/n7QSisYh Q3MG374Dnes6nBXsA5vRLxUslm2dVm0C+K0cstp49qDIj4ApZpHGogvgoqJU+5AY7z RfQbfY4c6a+5C7akL2T9IQc39wKNU91GUGOqIFyhIadASsl1MUEZzN5dMaNdb/334F fLQmfKssrir+dkLLXcWVuqUOFd5AfRO9kwYs4dX6ypRFTbwZtu3LVeM9235r/ou0OJ QZ7baSp27lBY+QGlTjZT9Mwkdf+YhonwIZzKSionJk1IO6eE9uyxoPg0dD1uLp4iBy 7P+dKOVLGEynw==
Date: Sun, 30 Aug 2026 16:33:43 +0000
To: Mark Nottingham <mnot@mnot.net>, "httpapi@ietf.org" <httpapi@ietf.org>, Martin Thomson <mt@lowentropy.net>
From: Rahul Gupta <cxres@protonmail.com>
Message-ID: <G7I3AS6MHH3UbcEWi4ZV55g0Mal9UHT-VcuJRa71bbetHlSZKV5SjzYxRL0a7VMJlq_LdSj5VM4s6Kn8OGuA2HcZ47uYzQgxX_EMHRaplV8=@protonmail.com>
In-Reply-To: <480DD599-C505-4B75-BB02-B5CC7C4D7E72@mnot.net>
References: <ff1935b8-b2c0-4322-8d6d-3797650eaa49@app.fastmail.com> <480DD599-C505-4B75-BB02-B5CC7C4D7E72@mnot.net>
Feedback-ID: 919445:user:proton
X-Pm-Message-ID: 1dc1f563f1f554b21317f67ed4aa0e13d12fceeb
MIME-Version: 1.0
Content-Type: multipart/signed; protocol="application/pgp-signature"; micalg="pgp-sha512"; boundary="------11ac316b560a14a7a01e6c0777d6cb6d4c54b194193e97939f553cd1a9fb331c"; charset="utf-8"
Message-ID-Hash: 4YWHN7G2LVYAGA7VC2RV46W35KKNFXVX
X-Message-ID-Hash: 4YWHN7G2LVYAGA7VC2RV46W35KKNFXVX
X-MailFrom: cxres@protonmail.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [httpapi] Re: x402
List-Id: Building Blocks for HTTP APIs <httpapi.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/httpapi/2JqEgAEtEqcxmD4dduyTU1L7_4k>
List-Archive: <https://mailarchive.ietf.org/arch/browse/httpapi>
List-Help: <mailto:httpapi-request@ietf.org?subject=help>
List-Owner: <mailto:httpapi-owner@ietf.org>
List-Post: <mailto:httpapi@ietf.org>
List-Subscribe: <mailto:httpapi-join@ietf.org>
List-Unsubscribe: <mailto:httpapi-leave@ietf.org>
Hi Mark, 402 response probably also SHOULD indicate a way for the client to communicate that they have already paid (I am thinking of means such as oauth bearer token or a payment receipt hash, which may differ per resource) when they retry the request. I suspect you have not mentioned it in the draft because it seems obvious. BR/Rahul On Sunday, August 30th, 2026 at 9:11 PM, Mark Nottingham <mnot@mnot.net> wrote: > Hi Martin, > > Yes. Without any comment on the specifics of any proposal, I note that it's not the only work in this area -- there are a few folks out there attempting to use 402. E.g., > > • x402 — https://docs.x402.org/schemes/overview > • h402 — https://h402.xyz/ > • L402 / LSAT — https://github.com/lightninglabs/L402 > • draft-httpauth-payment — https://datatracker.ietf.org/doc/draft-httpauth-payment/ > > ... with several more expired proposals floating around AIUI. > > Personally, I'm not terribly keen to encourage activity in this space (the pitfalls of micropayments are many), but avoiding conflicts and bad practice might necessitate saying something. So, I've thrown together a quick draft that has been floating around in the back of my head along those lines. See: > https://projects.mnot.net/I-D/draft-nottingham-httpbis-402.html > > Thoughts? > > > > On 30 Aug 2026, at 11:44 am, Martin Thomson <mt@lowentropy.net> wrote: > > > > Hi everyone, > > > > It looks like some well-intentioned people at the Linux Foundation have decided to define the semantics of the 402 status code. > > > > I have opinions about the quality of their work (let's be frank, this is not good work; it reads like AI slop), but the more substantive point here is that the IETF is the right place to define the semantics of status codes. Should we ask them nicely to desist? > > > > There are some pieces that an external project should be free to define. They define some header fields for use in indicating how to make payments. Those might be cryptocurrency garbage (I'm not going to apologize for my contempt of that technology) but those don't need to be our business. > > > > Cheers, > > Martin > > > > -- > Mark Nottingham https://mnot.net/ > > >
- [httpapi] Re: x402 Rahul Gupta