IETF Logo Mail Archive

Re: x402

Mark Nottingham <mnot@mnot.net> Tue, 01 September 2026 14:34 UTC

Received: by mail2.ietf.org (Postfix) id 886FF1331C150; Tue, 1 Sep 2026 07:34:20 -0700 (PDT)
Delivered-To: ietfarch-httpbisa-archive-bis2juki@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 7A1631331C14F for <ietfarch-httpbisa-archive-bis2Juki@mail2.ietf.org>; Tue, 1 Sep 2026 07:34:20 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1788273260; bh=uLrYks8xCriX/jALbCCMOWaJct+zq+FLfgI6J58LULc=; h=Resent-Date:From:In-Reply-To:Date:Cc:References:To:Subject: Resent-From:Resent-Sender:List-Id:List-Help:List-Post: List-Unsubscribe; b=mYoae5pHETlyMFqeeu2BJdw04JWFVZQ+7zZb7AQhlwBYRDt3Y5I4tCJO/SLNNhXLc hhJcvjsvKJnRuGzaVHRt0Lqg917iMXPsyB8oqAzDJlOJnC7vMKSEj4VWEtF5lfAeV2 RyFlAIxLczMBFk1XlCU9QpKxUZx9VFlpckQEsQ9w=
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -5.4
X-Spam-Level:
X-Spam-Status: No, score=-5.4 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, MAILING_LIST_MULTI=-1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=w3.org header.b="F6LwA1bU"; dkim=pass (2048-bit key) header.d=w3.org header.b="nTj9vrCg"; dkim=pass (2048-bit key) header.d=mnot.net header.b="XhnrEXqg"; dkim=pass (2048-bit key) header.d=messagingengine.com header.b="S2FACNIN"
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bsMR1Hqypm0b for <ietfarch-httpbisa-archive-bis2Juki@mail2.ietf.org>; Tue, 1 Sep 2026 07:34:19 -0700 (PDT)
Received: from mab.w3.org (mab.w3.org [IPv6:2600:1f18:7d7a:2700:d091:4b25:8566:8113]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-256) server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id CE33A1331C14A for <httpbisa-archive-bis2Juki@ietf.org>; Tue, 1 Sep 2026 07:34:19 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=w3.org; s=s1; h=Subject:To:References:Message-Id:Cc:Date:In-Reply-To:From: Mime-Version:Content-Type:Reply-To; bh=A+4lHZvCFftBqFMxV15BSanjwXsx5Gum2tkMaC5EhMc=; b=F6LwA1bUvyLPlNJ1CW3YpJE8+3 W7rs4MFwqkwPeD6K+a4yJUAYnPO0HmT5/HK9nok+F2oQ+skmjxw6y+gi/tqSI5EHLj57kETvqEOcw N2Oa9SCWD/AGNnqSABuJj/Hb41ElIY93DP10BlrSGbQ1jvjc5H8wV1uYLHZEpW0iyScfui758IKU9 OAnDdSlybY+9EENIOCShKyhAJDF4psWONOahT+u5bB5CdAVwEUSemN0X3E+PXfdsDPK+xRVqtnAZh Rm7v/GUG2UzA3TKslGaYPDxyNfHGLqCOe9IomhMzJvDPN8fFTyFbotQkMmJ3oB2TqSqVEgz5QrBFY qQG1QfLA==;
Received: from lists by mab.w3.org with local (Exim 4.98.2) (envelope-from <ietf-http-wg-request@listhub.w3.org>) id 1x1PY6-0000000HUiV-3FCI for ietf-http-wg-dist@listhub.w3.org; Tue, 01 Sep 2026 14:33:18 +0000
Resent-Date: Tue, 01 Sep 2026 14:33:18 +0000
Resent-Message-Id: <E1x1PY6-0000000HUiV-3FCI@mab.w3.org>
Received: from ip-10-0-0-144.ec2.internal ([10.0.0.144] helo=pan.w3.org) by mab.w3.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from <mnot@mnot.net>) id 1x1PY3-0000000HUaT-0T7g for ietf-http-wg@listhub.w3.internal; Tue, 01 Sep 2026 14:33:15 +0000
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=w3.org; s=s1; h=To:References:Message-Id:Cc:Date:In-Reply-To:From:Subject: Mime-Version:Content-Type:Reply-To; bh=A+4lHZvCFftBqFMxV15BSanjwXsx5Gum2tkMaC5EhMc=; t=1788273195; x=1789137195; b=nTj9vrCgXxHx+FGMKWcs5MAjD2vkyb/Q94ChwdSQ8qO10522EX3OoMJzxZfmMQE3zFFHL+KCmq/ rUITwyVUeoEQKJBHRJe9CAjTTxNpY72jpZGHcCJ2ztZwMOc4zT3ARjCT3eryD98lXWeZ3dhXiiX9F 3/JJpU7mv/79jhSrZ6wmTHGgpYLA9fuqZqAMKDV7k7K4BVvP3EmRtg5qkqJCjG15xP8vNq4F6XSiz vT1tyIcP2V8NgEHQCA00d8GIvEQ0xhl12be5MDyOO9zS3yxGQKFUyqa3MtOpW7SJQ1gTNV/xYBMI7 4deCjtkxag9AFHrAYjJ2QPPsROkLceEuMpaA==;
Received-SPF: pass (pan.w3.org: domain of mnot.net designates 202.12.124.148 as permitted sender) client-ip=202.12.124.148; envelope-from=mnot@mnot.net; helo=fout-b5-smtp.messagingengine.com;
Received: from fout-b5-smtp.messagingengine.com ([202.12.124.148]) by pan.w3.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from <mnot@mnot.net>) id 1x1PY2-000000070uh-1NLR for ietf-http-wg@w3.org; Tue, 01 Sep 2026 14:33:15 +0000
Received: from phl-compute-03.internal (phl-compute-03.internal [10.202.2.43]) by mailfout.stl.internal (Postfix) with ESMTP id 559C71D00081; Tue, 1 Sep 2026 10:33:10 -0400 (EDT)
Received: from phl-frontend-03 ([10.202.2.162]) by phl-compute-03.internal (MEProxy); Tue, 01 Sep 2026 10:33:10 -0400
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mnot.net; h=cc :cc:content-transfer-encoding:content-type:content-type:date :date:from:from:in-reply-to:in-reply-to:message-id:mime-version :references:reply-to:subject:subject:to:to; s=fm1; t=1788273190; x=1788359590; bh=A+4lHZvCFftBqFMxV15BSanjwXsx5Gum2tkMaC5EhMc=; b= XhnrEXqgjfV6GiN2JuDTf2lC564rUlCpWJdMDXF+bv6wpbbd2G8d4gN01EsDepGG J2orwn5w7r1ME5vbAR5ZNikctFZxBVolCpuUJdiaE88hDhXZaZkF/yzEPobuApJO +dWbwCD/ri+LdseZw1xT+Fs3HVGnnMXsbPS2/xQJUqMpymYid0z74emalTjM4uC+ gndiQtfUjqj3RKuA9GwCsm/wnkNSHOVyXsLqheMg1xmORoRxqu3eSjNiWfR+OmPU lY5ujB94kTBXuJRGcZ+2WdnpWkoqSvOzitK0NNT+5VDs57qlLDLUXtX2vyXO9gOJ HOhTfAfxE8HiXZBAZ7tbag==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:content-type:date:date:feedback-id:feedback-id :from:from:in-reply-to:in-reply-to:message-id:mime-version :references:reply-to:subject:subject:to:to:x-me-proxy :x-me-sender:x-me-sender:x-sasl-enc; s=fm3; t=1788273190; x= 1788359590; bh=A+4lHZvCFftBqFMxV15BSanjwXsx5Gum2tkMaC5EhMc=; b=S 2FACNINNt6GLOvbCj+14njSBTF17JS98mjKNx9aQuKx0XOAEiZHyic9qYnit1Dxa IHWWBWNuLqsGE4hoUu9tfZzXdAZiEQzCokJgizXTE29YcsKYTLOsYdR4f6dlX1lq yL1AbhOuLJpySASY84RyNirxCaYXUuAplko49UpaJC4IoZYIdso9yz48Sp/OAe7b 5pV7buVTJWfnvedpCZXK0pLzff4ogewsGYyJoFBO2rapdMdOCc1SSMqbwHPzE7zE n/FOWREsxg33F6wm824E8ddh4BjnhtuCN1YGO9PS0O4bptslChvpD+tHJirX9fnb NsJV93btRA5CKhfPHoJvg==
X-ME-Sender: <xms:JeKWasWpe-F6nYrxCh3nJdYVCAhVJG8tV2LBNYV8ICz-kxlNLdjUXA> <xme:JeKWanct947I5Ey1TP4z8bF2v-M2_niPd7Hegzt_DJURC7leMyqc9mm7ZS8njedkx LrGV8oxxOoht7zuXtcwSRESAoAPlKYVc0932Qa9ZijFhH3A2r7CQ-c>
X-ME-Received: <xmr:JeKWaovY3bByPmWNmI2nz1LLs_Na9mjBg5XoHvovqq3mMN1ZqF4ayJ9vhVztAjHCnNGq3bI>
X-ME-Proxy-Cause: dmFkZTGK1h7P7fFZk1rZH1IVL8JaMw8D6n7eGRQXU7CqADMQroCsz9gHKgVIEQWi+kN/6a rMIU4ta9IqoHf13VSorKavGwn7DqrpkovRl5ifTX8y9zkKXLfCWB/vb5bSSURdpRwJFZEr VYWkwZ6JvlayAwwEGNjH5ZTqKaXuTk+rr+UiA40eZEtUslBcEqA1UGwuDuS/ykOBQfu4x5 2+LP/zmoT9k+SKH0ENKrwyH89RziKuVBKstXQVKfyTU2CxCh6pPnWsmLoQg5HR/WGZ4SO/ phxNQMOx1UmUyyzN+vJA27sXsW1aSHSPjXOMaME2yFeRFvCQeft/qkSJZSe9/D4MJcH2PU vtPdpW2copnyzGsoDe2XV3tDdrLmBnVQyDlB4zHgnGDeLOcEA2IppMSXkWGxJ86WYY/dVI WM93kozj+S6+rHx3sVcY+dJ96S1DgY5uDh8kNXoDIgS3KO9+Rbqz8HO0Ym7WZnvWlJwCn9 02DsPCG3OJGwSpo/EF1ZjdAoO9esNpkKjg8mvhjn47HXmP7X/OyV91gGW3ceESbW+ctc3j vb+0nVAqL1LTNozyh97Y/LjWZsPo7JC5JDJMqHv8GFW/LkTBX2Kv/OjiUSTivzvgH9kXEv QepQbLT8FNzbD9lzGvlxbiCAuIn0JW5Ac+AuAbeNtH6E+y12y9vaPlx2c5/A
X-ME-Proxy: <xmx:JeKWam8_x05fDN0Ghvq3rbJ3RVz_I9BdWkrl8YX3ByNURhAa5OBWQQ> <xmx:JeKWaj15PX9umtOU3vZL7TMw2g78eWRh8Kwrtf9-Z_GCg3ttOTJh_Q> <xmx:JeKWarDGURautbrlNN7nuHJRiNNt3do20X1gZfRCeG9sZeDvhadW-w> <xmx:JeKWavcAzRlKhefYd_OoKJqiqEtV1PXu5LeGhSWBm-Cv0fmYkYhrMQ> <xmx:JuKWauCpFsJVuLwUEOg9pbJGmJqliZO-EWjAgeS30scSjb1VAxG-U155>
Feedback-ID: ie6694242:Fastmail
Received: by mail.messagingengine.com (Postfix) with ESMTPA; Tue, 1 Sep 2026 10:33:08 -0400 (EDT)
Content-Type: text/plain; charset="utf-8"
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3864.700.51.1.1\))
From: Mark Nottingham <mnot@mnot.net>
In-Reply-To: <3ABAB697-5096-4657-B7D7-3EF938D8433A@gbiv.com>
Date: Tue, 01 Sep 2026 16:33:06 +0200
Cc: Martin Thomson <mt@lowentropy.net>, Poul-Henning Kamp <phk@phk.freebsd.dk>, Tim Bray <tbray@textuality.com>, ietf-http-wg@w3.org
Content-Transfer-Encoding: quoted-printable
Message-Id: <294BFA07-0F2D-4BBE-A353-11278AA70E38@mnot.net>
References: <ff1935b8-b2c0-4322-8d6d-3797650eaa49@app.fastmail.com> <480DD599-C505-4B75-BB02-B5CC7C4D7E72@mnot.net> <CAHBU6iveug5k686NM4RoDbi47jbNUF05nUjG3w0yKyAz6BTT0g@mail.gmail.com> <6a948d8f.b860f.2e9afe73@critter.freebsd.dk> <b14a9b2d-44df-48d0-a67f-5681e47f8ae4@app.fastmail.com> <3ABAB697-5096-4657-B7D7-3EF938D8433A@gbiv.com>
To: "Roy T. Fielding" <fielding@gbiv.com>
X-Mailer: Apple Mail (2.3864.700.51.1.1)
X-W3C-Hub-DKIM-Status: validation passed: (address=mnot@mnot.net domain=mnot.net), signature is good
X-W3C-Hub-DKIM-Status: validation passed: (address=mnot@mnot.net domain=messagingengine.com), signature is good
X-W3C-Hub-Spam-Status: No, score=-9.8
X-W3C-Hub-Spam-Report: BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, DMARC_PASS=-0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, W3C_AA=-1, W3C_DB=-1, W3C_IRA=-1, W3C_IRR=-3, W3C_WL=-1
X-W3C-Scan-Sig: pan.w3.org 1x1PY2-000000070uh-1NLR 84ff0c34608d3d54911179b7f0af1cc7
X-Original-To: ietf-http-wg@w3.org
Subject: Re: x402
Archived-At: <https://www.w3.org/mid/294BFA07-0F2D-4BBE-A353-11278AA70E38@mnot.net>
Resent-From: ietf-http-wg@w3.org
X-Mailing-List: <ietf-http-wg@w3.org> archive/latest/54176
X-Loop: ietf-http-wg@w3.org
Resent-Sender: ietf-http-wg-request@w3.org
Precedence: list
List-Id: <ietf-http-wg.w3.org>
List-Help: <https://www.w3.org/email/>
List-Post: <mailto:ietf-http-wg@w3.org>
List-Unsubscribe: <mailto:ietf-http-wg-request@w3.org?subject=unsubscribe>

> On 1 Sep 2026, at 9:06 am, Roy T. Fielding <fielding@gbiv.com> wrote:
> 
> I don't have an opinion on whether "the IETF" should weigh in on
> the current proposals, other than to suggest that this code was
> reserved by the IETF to define for those semantics (eventually).

I think the question here (if we decide to do anything) is whether we try to provide a framework for payment -- somewhat in the way that 401/407 have an associated authentication framework -- or whether we just define the status code's general semantics and let them be refined by the specific mechanism in use (by headers, content, etc.).

ChargeTo/Cost seems to be the former; my straw-man draft takes the latter approach for a few reasons. First, there seems to be little interest on working on this in this WG, but there's still a HTTP component to be defined. Second, the use cases and specifics of payment will be difficult to capture in a single framework -- we're very likely to preclude some reasonable things, or just flat get it wrong. Third, there are (as mentioned) already a number of folks using this (with various degrees of maturity), and from what I can see the likelihood of convincing them to switch over to a framework that we define is pretty low.

Cheers,

--
Mark Nottingham   https://mnot.net/

v2.46.0 | Report a Bug | By Email | System Status