402 Payment Required

402 Payment Required is reserved in RFC 9110 for future use. It was defined in the earliest HTTP specifications with the idea of supporting digital cash or micropayment schemes directly at the protocol level, but no such mechanism was ever standardized, and browsers have no built-in handling for it. For decades it sat almost entirely unused in real traffic, unlike its 4xx siblings which describe concrete, well-understood failure modes.

In the last several years, a growing number of APIs and platforms have repurposed 402 informally to signal billing-related failures: an expired subscription, an exhausted usage quota that requires an upgrade, insufficient account credit, or a free tier limit reached. Because the code is officially reserved rather than formally redefined for this purpose, there is no standardized error body format the way OAuth defines one for 401, so each provider documents its own JSON error shape.

Because 402 has no native browser or proxy behavior tied to it, it is safe to reuse for application-level billing errors as long as the meaning is documented and the response body carries actionable detail, such as which plan is required, current usage versus limit, and a link to resolve billing. Some providers instead layer this information onto a 403 or a custom 4xx-adjacent code paired with a JSON error field, so a caller should not assume 402 exclusively means billing without checking the specific API's docs.