agenticweb.wiki

L402 L402

Pay L402 (formerly LSAT, Lightning Service Authentication Token) is an HTTP authentication scheme, developed by Lightning Labs, that combines the dormant HTTP 402 status code with Lightning Network micropayments to let a client pay for and then authenticate to a metered API resource in a single credential [1][2]. A server challenges with HTTP 402 plus a WWW-Authenticate: L402 header containing a macaroon and a BOLT-11 Lightning invoice; the client pays the invoice, receives a payment preimage, and re-presents macaroon:preimage in an Authorization header on retry — the server verifies statelessly by checking that the preimage hashes to the payment hash embedded in the macaroon, with no database lookup [1].

Overview

It solves pay-per-use API access without accounts, passwords, or centralized session state, and its macaroon-based credentials support caveats and attenuation, so a holder can mint a narrower, delegated sub-credential for another party (including another agent) without contacting the issuing server [2]. It does not itself define a currency or settlement rail beyond the Lightning Network, and it is explicitly scoped to authentication plus payment proof, not to cart-building, catalog discovery, or dispute resolution — those are left to whatever service sits behind the challenge.

The specification is precise about status-code discipline: 402 is reserved exclusively for the initial payment challenge, while a 401 is returned once any credential (valid-looking or not) has been submitted, so clients can distinguish "you must pay" from "your credential is broken" [1]. As of this verification, the specification lives on the master branch of lightninglabs/L402 with no separately dated release tag observed, and Lightning Labs also operates a reference reverse-proxy implementation (Aperture) that gates access to metered services with L402 in production. No independent, dated count of production L402 deployments was located during this verification, so adoption is recorded as unmeasured rather than claimed or observed — Lightning Labs' own materials assert active use but do not publish a number in the sources checked.

Discovery and probe

HTTP 402 response carrying a WWW-Authenticate challenge · none — signalled per-request, no well-known file

GET {origin}/{paid-path}
parse:     HTTP 402 status with a WWW-Authenticate: L402 macaroon="...", invoice="..." header
on absent: A 200, 401, or a 402 without an L402-scheme WWW-Authenticate header means this path does not issue L402 challenges; the credential scheme is registered under RFC 7235 so a server could in principle offer it alongside other schemes on the same 401/402 responses.

Not probed live: no-fixed-path. L402 challenges appear only on paid URLs.

History

Instances

Every instance with its source is listed on the instances page.

See also

References

  1. L402's protocol specification defines the credential as a `<macaroon>:<preimage>` pair, the challenge as `WWW-Authenticate: L402 macaroon=..., invoice=...` on a 402, and requires servers to switch to 401 (not 402) once a credential has been presented but fails verification. — https://raw.githubusercontent.com/lightninglabs/L402/master/protocol-specification.md VERIFIED
  2. The L402 README states it was developed by Lightning Labs, evolved from the earlier LSAT (Lightning Service Authentication Token) concept, and is designed to fit agentic use cases where an AI agent discovers, pays for, and authenticates to a service without human intervention, including delegated sub-credentials via macaroon caveat attenuation. — https://raw.githubusercontent.com/lightninglabs/L402/master/README.md VERIFIED

JSON · Markdown