agenticweb.wiki

L402

Last checked · 41 primary sources

This page is about L402 (formerly LSAT), the Lightning Labs scheme that sends a macaroon and Lightning invoice in a WWW-Authenticate header with an HTTP 402 "Payment Required" response, so a client can pay over the Lightning Network and then authenticate with the payment receipt. It is not x402, the open payment protocol started at Coinbase that uses the HTTP 402 "Payment Required" status code [25]; not MPP, the Machine Payments Protocol (MPP) co-authored by Tempo and Stripe, which uses its own Payment scheme [24]; and not the bare 402 status code, which RFC 9110 leaves "reserved for future use" [23] (see HTTP 402 Payment Required).

Overview

L402 lets a web service charge for an API call or a piece of content over the Lightning Network, using the HTTP 402 status code and the standard WWW-Authenticate and Authorization headers [1][2]. The server hands the client a token and a Lightning invoice; paying the invoice gives the client a preimage that, together with the token, proves payment on later requests until the token expires or is revoked [1][14]. Lightning Labs published it in 2020 as LSAT, renamed it L402 in 2023, and since 2023 has promoted it as a payment method for AI agents, alongside tools such as the Aperture proxy and the lnget client [1][5][11][12][13][14]. Its tokens were originally macaroons, which a holder can restrict before sharing; the 2026 bLIP revision makes the token format open [2][7].

Who uses it

Sellers that answer with L402 challenges, the proxy and processor software that issues them, and the gateways that settle. Each vendor position is dated; header checks were unpaid GETs on 2026-10-29 (nothing was paid; token and invoice values masked).

On the Mutinynet signet test network ("A signet with 30-second blocks." [32]), https://faucet.mutinynet.com/api/l402 also answered an unpaid GET on 2026-10-29 with HTTP 402 and WWW-Authenticate: L402 token=… (no version parameter).

Who reads it

Agent-side clients, SDKs and wallets that read L402 challenges and pay them. Each vendor position is dated. Cloudflare's Agents SDK payments documentation (last updated 2026-08-05) names only x402 and MPP: "Cloudflare's Agents SDK supports agentic payments through two protocols built on the HTTP 402 Payment Required status code: x402 and Machine Payments Protocol (MPP)." [21]

Recent coverage

See also

References

  1. Lightning Labs, lightninglabs/L402, protocol-specification.md (GitHub, master branch), checked 2026-10-29: "This document specifies the L402 authentication scheme for HTTP and gRPC." "WWW-Authenticate: L402 macaroon="<base64>", invoice="<bolt11>"" "Authorization: L402 <base64(macaroon)>:<hex(preimage)>" "The 402 status code is used exclusively for the initial payment challenge." "Once a client presents a credential (valid or not), the server MUST respond with 401 if verification fails, not 402." "The L402 scheme is registered under the HTTP Authentication Framework specified in [RFC 7235](https://tools.ietf.org/html/rfc7235)." "The L402 protocol was formerly known as LSAT." "Servers SHOULD send both `LSAT` and `L402` scheme names in `WWW-Authenticate` challenge headers." "Clients and servers MUST accept both `LSAT` and `L402` in `Authorization` headers." "This binding enables stateless verification: the server checks `H == sha256(preimage)` against the hash embedded in the macaroon, with no database lookup required." — https://raw.githubusercontent.com/lightninglabs/L402/master/protocol-specification.md
  2. Lightning Labs, lightninglabs/L402, README.md (GitHub, master branch), checked 2026-10-29: "L402 is an open protocol for paying for and authenticating access to APIs and services over the internet using the Lightning Network." "Macaroons support attenuation: a credential holder can create a weaker version of their credential to share with others, restricting access to specific services, capabilities, or usage limits." "L402 is a natural fit for AI agents and autonomous software that need to discover, evaluate, and pay for services without human intervention." "boltwall: Node.js middleware-based authentication using L402" "lsat-js: JavaScript utility library for working with L402 credentials" — https://raw.githubusercontent.com/lightninglabs/L402/master/README.md
  3. GitHub API, repository metadata for lightninglabs/L402, checked 2026-10-29: ""created_at": "2020-02-07T20:53:31Z"" ""license": null" — https://api.github.com/repos/lightninglabs/L402
  4. GitHub API, commit list for lightninglabs/L402 (commits of 2026-03-20), checked 2026-10-29: "docs: revert BLIP-0026 header changes, remove legacy files" "docs: fix agent-spec for pre-BLIP master" — https://api.github.com/repos/lightninglabs/L402/commits?per_page=100
  5. GitHub API, lightninglabs/L402 pull request #16, "Edit documentation to reflect naming changes" (Liongrass), checked 2026-10-29: "The LSAT protocol shall henceforth be known as the L402 protocol." ""merged_at": "2023-04-20T22:57:13Z"" — https://api.github.com/repos/lightninglabs/L402/pulls/16
  6. GitHub API, lightning/blips pull request #26 (Olaoluwa Osuntokun), checked 2026-10-29: ""title": "blip-0026: L402 - Lightning HTTP 402 Protocol "" ""state": "open"" ""created_at": "2023-06-07T02:38:15Z"" ""merged_at": null" "In this commit, we add a bLIP for the L402 (formerly known as LSAT)" — https://api.github.com/repos/lightning/blips/pulls/26
  7. Olaoluwa Osuntokun, Oliver Gugger and Wilmer Paulino, blip-0026.md at the head commit of lightning/blips PR #26 (Roasbeef/blips@697ae35), checked 2026-10-29: "bLIP: 26 Title: L402: The Lightning HTTP 402 Protocol Status: Active" "Created: 2023-06-06 License: CC0" "The L402 protocol is token-format agnostic: any authentication token that can commit to a payment hash may be used." "WWW-Authenticate: L402 version="0", token="T", invoice="P"" "Servers SHOULD accept `macaroon=` in addition to `token=` when parsing client requests and `WWW-Authenticate` headers from upstream proxies." — https://raw.githubusercontent.com/Roasbeef/blips/697ae354c205f1aacc450e72067c92a7f2467321/blip-0026.md
  8. GitHub API, comments on lightning/blips PR #26 (Olaoluwa Osuntokun, 2026-02-25 and 2026-03-11 UTC), checked 2026-10-29: "add version field as suggested above" "We plan on continuing development of the protocol there." — https://api.github.com/repos/lightning/blips/issues/26/comments?per_page=100
  9. Lightning Labs, L402: Lightning HTTP 402 Protocol | Builder's Guide, checked 2026-10-29: "L402 is the standard for selling and buying digital resources." "Response: The server responds with HTTP 402 Payment Required and a WWW-Authenticate header containing a token and a Lightning invoice." "Aperture is used today by Lightning Loop, a non-custodial swap service for Bitcoin and Lightning." — https://docs.lightning.engineering/the-lightning-network/l402
  10. Lightning Labs, Protocol Specification | Builder's Guide (L402), checked 2026-10-29: "Alongside the 402 status code, the server should specify the WWW-Authenticate header ([RFC 7235], Section 4.1) field to indicate the L402 authentication scheme and the macaroon needed for the client to form a complete L402." — https://docs.lightning.engineering/the-lightning-network/l402/protocol-specification
  11. Olaoluwa Osuntokun, L402: Authentication and Payments for the Lightning-Native Web (Lightning Labs blog), 2020-03-30: "Olaoluwa Osuntokun March 30, 2020" "Today we're excited to announce the release of our draft of a specification for Lightning Service Authentication Tokens (L402)." "Alongside this specification, we're also releasing Aperture, our implementation of an HTTP-402 (Payment Required) L402 reverse proxy which is used in production today by Lightning Loop." — https://lightning.engineering/posts/2020-03-30-lsat/
  12. Olaoluwa Osuntokun and Michael Levin, AI for All: Powering APIs and Large Language Models with Lightning (Lightning Labs blog), 2023-07-06: "Olaoluwa Osuntokun and Michael Levin July 6, 2023" "L402 HTTP API Traversal: a Python wrapper for a LangChain LLM chain (APIChain) that enables agents to transparently access L402 payment-metered APIs." "L402 bLIP: a Bitcoin Lightning Improvement Proposal (bLIP) specification for the L402 protocol standard to openly share the primitives for building these components with the community." — https://lightning.engineering/posts/2023-07-05-l402-langchain/
  13. Michael Levin, The Agents Are Here and They Want to Transact: Powering the AI Economy with Lightning (Lightning Labs blog), 2026-02-11: "Michael Levin February 11, 2026" "Today, we're open sourcing a new set of tools that give AI agents the skills to operate natively on the Lightning Network." "Today's launch also includes lnget, an L402-aware command-line HTTP client (similar to wget/curl) that enables agents to seamlessly navigate L402-gated APIs and content." "lnget handles the buying, Aperture handles the selling and Lightning settles the payments." — https://lightning.engineering/posts/2026-02-11-ln-agent-tools/
  14. Michael Levin, The Future Is Now: Why L402 Is the Internet-Native Payments Protocol for Agents (Lightning Labs blog), 2026-03-11: "Michael Levin March 11, 2026" "L402 is formalized as bLIP-0026, a Bitcoin Lightning Improvement Proposal (bLIP) submitted to the open Lightning specification repository." "We're enabling the protocol to evolve without breaking existing clients by including a version parameter (currently "0") in WWW-Authenticate challenge header." "The specification now expands the language beyond just macaroons, using token instead of macaroon as the key name in the challenge header." "Once a token is obtained, it can be cached and reused for subsequent requests to the same service until it expires or is revoked." — https://lightning.engineering/posts/2026-03-11-L402-for-agents/
  15. GitHub API, repository metadata for lightninglabs/aperture, checked 2026-10-29: ""description": "⚡️L402 (Lightning HTTP 402) Reverse Proxy ⚡️"" ""spdx_id": "MIT"" — https://api.github.com/repos/lightninglabs/aperture
  16. GitHub API, lightninglabs/aperture release v0.5.0, published 2026-03-25: "This is a major release that transforms Aperture from a static L402 reverse proxy into a full-featured, dynamically manageable payment gateway." "The scheme coexists alongside the existing L402 protocol — clients can choose whichever authentication method they support." "merging `WWW-Authenticate` headers so a single 402 can advertise `LSAT`, `L402`, and `Payment` challenges simultaneously" — https://api.github.com/repos/lightninglabs/aperture/releases/tags/v0.5.0
  17. Lightning Labs, Aperture | Builder's Guide, checked 2026-10-29: "Aperture is an implementation of L402s as a reverse HTTP proxy." "Aperture implements both the L402 as well as the MPP specifications." — https://docs.lightning.engineering/lightning-network-tools/aperture
  18. Alby, 402, Charted - Tracking the rise of L402, x402, and MPP (Alby blog), 2026-08-12: "For developers building AI agents, that means supporting multiple payment protocols." "l402.space is a universal 402 gateway between your agent's wallet and everyone else's rail." — https://getalby.com/blog/402-charted-tracking-the-rise-of-l402-x402-and-mpp
  19. l402.space, /docs (Markdown), checked 2026-10-29: "Challenge: `WWW-Authenticate: L402 token="<macaroon>", invoice="<bolt11>"`." "You pay the gateway over YOUR rail; the gateway pays the upstream API on your behalf over whichever rail THAT API speaks (x402/USDC, MPP Tempo, MPP Lightning, or L402), then returns the upstream response to you." — https://l402.space/docs
  20. GitHub API, getAlby/cli release v0.4.0, published 2026-04-07: "Add unified command to fetch L402, X402 & MPP resource" — https://api.github.com/repos/getAlby/cli/releases/tags/v0.4.0
  21. Cloudflare, Agentic Payments · Cloudflare Agents docs, last updated 2026-08-05: "Cloudflare's Agents SDK supports agentic payments through two protocols built on the HTTP 402 Payment Required status code: x402 and Machine Payments Protocol (MPP)." — https://developers.cloudflare.com/agents/tools/payments/
  22. IANA, HTTP Authentication Scheme Registry (CSV), checked 2026-10-29: "Authentication Scheme Name,Reference,Notes" — https://www.iana.org/assignments/http-authschemes/authschemes.csv
  23. IETF, RFC 9110: HTTP Semantics, June 2022: "The 402 (Payment Required) status code is reserved for future use." — https://www.rfc-editor.org/rfc/rfc9110.html
  24. MPP, What is MPP? Machine-to-machine HTTP 402 payments | MPP, checked 2026-10-29: "The Machine Payments Protocol (MPP) is an open protocol co-authored by Tempo and Stripe." — https://mpp.dev/overview
  25. Linux Foundation, Linux Foundation Announces Operational Launch of x402 Foundation to Standardize Internet-Native Payments for AI Agents and Applications (press release), 2026-07-14: "x402 was started at Coinbase to solve a real problem – AI agents had no native, interoperable way to pay for the things they needed to do." — https://www.linuxfoundation.org/press/linux-foundation-announces-operational-launch-of-x402-foundation-to-standardize-internet-native-payments-for-ai-agents-and-applications
  26. Micah Zimmerman, Lightning Labs Releases AI Tools To Help Bitcoin Payments (Bitcoin Magazine), 2026-02-13: "A central feature of the release is lnget, a command-line HTTP client that works with the L402 payment standard." "Instead of requiring a login or API key, an L402-enabled server responds to a request with a Lightning invoice." — https://bitcoinmagazine.com/news/lightning-labs-rolls-out-ai-agent-tools
  27. Juan Galt, Lightning Labs Launches Wavelength: “Bitcoin On Easy Mode” For Developers And Autonomous Agents (Bitcoin Magazine), 2026-07-22: "This pairs with L402, Lightning Labs' protocol for machine-native authentication and per-request Lightning payments." — https://bitcoinmagazine.com/technical/lightning-labs-launches-wavelength-bitcoin-on-easy-mode-for-developers-and-autonomous-agents
  28. Linas Kmieliauskas, Bitcoin Losing AI Payments Battle per Blackrock, but Not the War (Bitcoin.com News), 2026-09-23: "Blackrock doesn't mention the Bitcoin Lightning Network or L402, its protocol for agentic payments." "Also, the Lightning Network can run under Stripe's/Tempo's Machine Payments Protocol (MPP), so the L402 statistics understate how many services actually accept Lightning." — https://news.bitcoin.com/stablecoins/bitcoin-losing-ai-payments-battle-per-blackrock-but-not-the-war/
  29. Lightning Labs, lightninglabs/loop, swap_server_client.go on master, checked 2026-10-29: "while delegating token acquisition and stream authentication to Aperture's" — https://raw.githubusercontent.com/lightninglabs/loop/master/swap_server_client.go
  30. Lightning Enable, Lightning Enable (llms.txt), checked 2026-10-29: "Infrastructure for agentic commerce over Lightning." "merchants (and agents acting as sellers) create and verify challenges directly" "Payouts land in the merchant's own Lightning wallet over Nostr Wallet Connect, or in a Strike or OpenNode account." — https://www.lightningenable.com/llms.txt
  31. Lightning Faucet, Lightning Faucet (llms.txt), checked 2026-10-29: "25+ pay-per-call endpoints, 5 to 500 sats" — https://lightningfaucet.com/llms.txt
  32. Mutinynet faucet, MUTINYNET, checked 2026-10-29: "A signet with 30-second blocks." — https://faucet.mutinynet.com/
  33. Tierion, Tierion/boltwall, Boltwall (README.md on master), checked 2026-10-29: "Bitcoin Lightning paywall and authentication using LSATs." — https://raw.githubusercontent.com/Tierion/boltwall/master/README.md
  34. GitHub API, repository metadata for Tierion/boltwall, checked 2026-10-29: "2023-04-26T19:00:52Z" — https://api.github.com/repos/Tierion/boltwall
  35. Lightning Labs, lightninglabs/lnget, lnget (README.md on main), checked 2026-10-29: "Verifies the invoice amount is within `--max-cost`" "Stores the token (macaroon + preimage) for the domain" — https://raw.githubusercontent.com/lightninglabs/lnget/main/README.md
  36. Lightning Labs, L402sdk: L402 client SDK for AI agent frameworks (lightninglabs/L402sdk on GitHub), checked 2026-10-29: "L402 client SDK for AI agent frameworks." "Built in Rust with TypeScript and Python bindings." — https://github.com/lightninglabs/L402sdk
  37. GitHub API, repository metadata for lightninglabs/LangChainBitcoin, checked 2026-10-29: "2024-07-03T00:51:20Z" — https://api.github.com/repos/lightninglabs/LangChainBitcoin
  38. Lightning Enable (Refined Element), refined-element/lightning-enable-mcp, Lightning Enable MCP Server (README.md on main), checked 2026-10-29: "Automatically pay L402 challenges for seamless API access" — https://raw.githubusercontent.com/refined-element/lightning-enable-mcp/main/README.md
  39. Lightning Faucet, lightningfaucet/lightning-wallet-mcp, Lightning Wallet (README.md on main), checked 2026-10-29: "Your agent can pay for L402 and X402 APIs, pay any Lightning invoice or Lightning address, receive payments, and hold sats, all through natural language tool calls." "Custodial, so there is nothing to run" — https://raw.githubusercontent.com/lightningfaucet/lightning-wallet-mcp/main/README.md
  40. Tierion, Tierion/lsat-js, LSAT-JS (README.md on master), checked 2026-10-29: "a suite of tools for working with LSATs in Nodejs and Typescript." — https://raw.githubusercontent.com/Tierion/lsat-js/master/README.md
  41. GitHub API, repository metadata for Tierion/lsat-js, checked 2026-10-29: "2023-08-09T14:13:30Z" — https://api.github.com/repos/Tierion/lsat-js

JSON · Markdown · OKF v0.2