Re: x402

[Tim Bray <[e-mail]>]

 Welllll…

RFC9110 says that 402 is “reserved for future use”. The solution is
obvious, let’s send the IETF enforcement squad after anyone who uses it
anyhow. Kidding, the squad should be reserved for people who put UTF-16 on
the wire.

The Wikipedia entry
https://en.wikipedia.org/wiki/List_of_HTTP_status_codes offers
a few more enforcement-squad targets.

I really am kidding, 402 feels like it ought to be useful and these people
as exploring use cases, maybe consensus will emerge and we can write an RFC.

As for x402.org, let’s see. Agents. Working around those inconvenient
Know-Your-Customer laws. Crypto. Definitely a bit of a smell. I wonder if
Google and Shopify and AWS and are really in on this?

I like Mnot’s draft but I think it’s probably not OK to avoid mentioning
that in every conceivable situation where payment is occurring, it occurs
against a legal backdrop. Maybe something along the lines of an assertion
that the use of 402 implies makes no legal claim cannot serve as a basis
for any legal claims for or against an entity issuing that status.

I’d go so far as to say something  "implementers MUST take legal issue
surrounding payment activities into consideration”.

-T

On Aug 30, 2026 at 8:39:43 AM, Mark Nottingham <[e-mail]> wrote:

> Hi Martin,
>
> Yes. Without any comment on the specifics of any proposal, I note that
> it's not the only work in this area -- there are a few folks out there
> attempting to use 402. E.g.,
>
>    • x402 — https://docs.x402.org/schemes/overview
>    • h402 — https://h402.xyz/
>    • L402 / LSAT — https://github.com/lightninglabs/L402
>    • draft-httpauth-payment —
> https://datatracker.ietf.org/doc/draft-httpauth-payment/
>
> ... with several more expired proposals floating around AIUI.
>
> Personally, I'm not terribly keen to encourage activity in this space (the
> pitfalls of micropayments are many), but avoiding conflicts and bad
> practice might necessitate saying something. So, I've thrown together a
> quick draft that has been floating around in the back of my head along
> those lines. See:
>  https://projects.mnot.net/I-D/draft-nottingham-httpbis-402.html
>
> Thoughts?
>
>
> On 30 Aug 2026, at 11:44 am, Martin Thomson <[e-mail]> wrote:
>
>
> Hi everyone,
>
>
> It looks like some well-intentioned people at the Linux Foundation have
> decided to define the semantics of the 402 status code.
>
>
> I have opinions about the quality of their work (let's be frank, this is
> not good work; it reads like AI slop), but the more substantive point here
> is that the IETF is the right place to define the semantics of status
> codes.  Should we ask them nicely to desist?
>
>
> There are some pieces that an external project should be free to define.
> They define some header fields for use in indicating how to make payments.
> Those might be cryptocurrency garbage (I'm not going to apologize for my
> contempt of that technology) but those don't need to be our business.
>
>
> Cheers,
>
> Martin
>
>
>
> --
> Mark Nottingham   https://mnot.net/
>
>
>