402 Payment Required

This is an educational reference page about HTTP 402 Payment Required. The page itself is served as 200 OK so it can be indexed as HTTP documentation.

Reserved for future use. The original intention was that this code might be used as part of some form of digital cash or micropayment scheme, as proposed, for example, by GNU Taler, but that has not yet happened, and this code is not widely used. Google Developers API uses this status if a particular developer has exceeded the daily limit on requests. Sipgate uses this code if an account does not have sufficient funds to start a call. Shopify uses this code when the store has not paid their fees and is temporarily disabled. Stripe uses this code for failed payments where parameters were correct, for example blocked fraudulent payments.

What it means

HTTP 402 Payment Required says the server is refusing the request for a billing or payment-related reason.

Common causes

An API account has no remaining credit, an unpaid invoice, or a disabled subscription.
A payment method was declined after the request itself passed normal validation.
A paid feature is blocked until the customer updates billing details or plan access.

How to fix it

Return a stable application error code such as payment_required, card_declined, or plan_required.
Tell the client the next safe action, such as updating billing details or choosing a plan.
Use 403 for permission problems and 429 for rate limits; reserve 402 for billing-related blocks.

Example response

HTTP/1.1 402 Payment Required
Content-Type: application/json

{"error":"payment_required","next":"update_billing"}

Developer notes

402 was originally reserved and is still not used consistently by browsers. It is most useful in documented APIs where clients know how to recover from billing states.

Questions

What does HTTP 402 mean?

HTTP 402 means the server will not complete the request until a billing or payment issue is resolved.

Is HTTP 402 standard?

HTTP 402 is reserved by the HTTP specification, but real services use it inconsistently. Document it clearly if your API returns it.

Should I use 402 or 403?

Use 402 when payment is the blocker. Use 403 when the user is authenticated but not authorized.