402 Payment Required was reserved in HTTP/1.1 for future use, with digital payment systems in mind. RFC 9110 still only says that it is "reserved for future use". No standard meaning, header or payment flow is attached to it.
Because the standard leaves it unused, some services have adopted it for their own needs: payment APIs use it when a charge fails, SaaS APIs when a plan's credit or quota is exhausted, and hosting platforms when an account is suspended for non-payment. More recently, schemes for paid access by AI crawlers and for machine-to-machine micropayments have started to use 402 to tell clients that access requires payment.
Clients that have no special handling treat 402 as a generic client error.
Example response
HTTP/1.1 402 Payment Required
Date: Fri, 06 Nov 2026 10:15:32 GMT
Content-Type: application/json
Content-Length: 90
{"error":{"type":"card_error","code":"card_declined","message":"Your card was declined."}}SEO and redirect checking
A 402 is a 4xx error for search engines, so the URL is not indexed. If you sell access to content and still want it to appear in search, do not return 402 to crawlers; serve the page with 200 and mark the paywalled part with structured data (isAccessibleForFree). Some CDN features deliberately answer AI crawlers with 402, which does not affect the search crawlers you allow.
Common causes and use cases
- A payment API reports that a card was declined or a charge failed.
- An API key's plan has run out of credits or exceeded its paid quota.
- A hosted shop or website is suspended because the account is unpaid.
- A pay-per-crawl or micropayment scheme asks the client to pay before it gets access.