Direct Answer
HTTP 402 Payment Required is a status code that signals a server will not serve a resource without payment or a licensed arrangement. Reserved and rarely used for most of the web's history, it is now being revived by crawl-control systems — including Cloudflare's pay-per-crawl approach — to charge or block automated crawlers that have no paid or permitted access to the content.
What HTTP 402 Actually Is
HTTP 402 Payment Required is part of the 4xx family of client-error codes, the same group as 403 Forbidden and 404 Not Found. The difference is its history: 402 was written into the HTTP specification decades ago as a placeholder for some future digital-payment scheme, then left almost entirely unused. For years, seeing a 402 in the wild was a curiosity.
That is changing. As automated traffic — search crawlers, price scrapers, and above all AI training and answer crawlers — grew into a large share of total web requests, some publishers looked for a status code that says something specific: this resource is available, but not to you for free, and not without a relationship. 402 fits that meaning better than a blunt 403.
A 402 is a policy signal, not a technical fault. Your request was well-formed and the resource exists. The server is telling you the terms of access have changed.
Why Publishers Are Turning to It
The immediate driver is the sheer volume of automated crawling. Large-scale AI systems need enormous amounts of text and data, and much of it is gathered by crawling the open web. For a publisher, that means serving bandwidth and compute to bots that may never send a human reader back — and whose output can even compete with the original site.
Faced with that, publishers have a few options. They can block automated crawlers outright, they can ignore the load, or they can try to be paid for it. A payment or licensing signal is the middle path: keep the content online, but attach terms to automated access.
Cloudflare's pay-per-crawl
The most visible move in this direction came from Cloudflare, which introduced a pay-per-crawl and AI-crawl-control system in 2025. The idea is that a publisher can let its content be crawled by bots that have a paid or licensed arrangement, and return an HTTP 402 to those that do not. It turns crawler access into something a publisher can price and control at the network edge, rather than a free-for-all.
More recently, mid-2026 reporting has described a pivot in this space toward a "pay-per-answer" model — charging based on AI systems using content to generate answers rather than simply crawling pages. That shift is still being reported and is evolving; the exact shape of it is not settled. What is stable is the underlying direction: automated access to some content is moving from free-by-default to gated-by-arrangement, and 402 is one of the signals that carries the message.
What a 402 Means for a Data Team
If you run legitimate data collection — competitor price monitoring, market research, catalogue tracking on German e-commerce sites — a 402 changes the question you should be asking. It is not a puzzle to route around. It is the publisher stating that automated access to this specific content now has terms.
A useful way to read the different signals you meet while collecting data:
| Response | What it means | The right response |
|---|---|---|
429 Too Many Requests |
You sent requests too fast | Slow down, back off, respect rate limits |
Cloudflare 1015 |
Rate limited at the edge | Reduce request rate, honour the limit |
402 Payment Required |
Access is gated behind payment or a licence | Seek permitted or licensed access |
403 Forbidden |
Access is refused outright | Check whether the content is meant to be public |
The first two are about pace — they reopen once you behave like a considerate client. A 402 is about permission and terms, and no amount of careful pacing changes that. The distinction matters: treating a 402 like a 429 wastes effort and misreads what the site is telling you. If you are still working out those first two, our guides on 429 Too Many Requests and Cloudflare error 1015 cover them in full.
The Responsible Stance
At GermanProxy.io our position on all of this is straightforward: respect the signal. A clean German mobile IP is infrastructure for reaching public data reliably as a well-behaved client — it is not a tool for defeating a publisher's stated terms, and it does not turn gated content into free content.
That means a few concrete things when you meet a 402:
- Read it as a policy, not an error. The site is telling you access needs payment or a licence. Rotating IPs does not create that arrangement, and trying to force it is both futile and the wrong footing.
- Seek licensed or permitted access. Many publishers now offer official APIs, data licences, or crawl agreements. Where content is genuinely gated, the durable path is a permitted one — it is more reliable than any workaround and it keeps you on the right side of the terms.
- Stay on public, permitted data. Plenty of valuable data — public product listings, prices, search results — remains openly available. Focus collection there, respect
robots.txtand rate limits, and do not store personal data. This is our positioning under EU and German law, not an afterthought. If you want the legal grounding, see the legal side of web scraping in Europe. - Be a good client everywhere else. Identify honestly, pace your requests, cache what you can, and do not hammer origins. Being a considerate crawler is what earns continued access — and it is exactly the behaviour publishers are trying to distinguish from abusive bot traffic.
This matters even more as automated agents do more of the fetching. An AI agent or browser automation agent that respects a 402 — stopping, logging it, and routing to a permitted source instead of retrying blindly — is a well-engineered agent. One that ignores it is building on sand.
Where the Metered Web Is Heading
The broader shift is often called the "metered web": a move away from the assumption that any bot can freely crawl anything, toward a model where automated access to some content carries terms — payment, a licence, or an explicit agreement. HTTP 402 is one of the mechanisms making that legible in a way both sides can read programmatically.
For data teams, the practical takeaway is not alarm. Most public data stays reachable, and the fundamentals do not change: use clean, dedicated German mobile IPs, be a polite client, and respect what sites tell you. What changes is that "the site said no, in a way that means pay or licence" becomes a normal signal to handle gracefully — the same way a mature pipeline already handles a 429 or a 1015. Build for it now and the metered web is a design detail, not a crisis.
FAQ
What does an HTTP 402 Payment Required response mean?
It means the server will not serve the resource without payment or a licensed arrangement. Historically 402 was reserved and rarely used, but crawl-control systems have started returning it to signal that automated access requires a paid or permitted relationship, not just a valid request.
Will rotating IPs get me past an HTTP 402?
No, and it is the wrong goal. A 402 is a policy decision at the publisher's edge, not a rate limit tied to one address. Changing IPs does not create the paid or licensed access the response is asking for. The correct response is to seek permitted access or licensed data.
How is HTTP 402 different from 429 or Cloudflare 1015?
A 429 or a Cloudflare 1015 means you sent too many requests too fast — slow down and the door reopens. A 402 is not about speed at all; it says access itself is gated behind payment or a licence, so no amount of polite pacing changes the answer.
CTA
Building data pipelines and agents that stay on public, permitted sources? Reach them with clean, dedicated German mobile IPs and handle every signal — 402 included — like a considerate client. Browse the German mobile proxy plans, or see how it works for AI agents.
Get a German mobile proxy: Real 4G/5G IPs from Germany, fair-use 20 GB/day — browse German mobile proxy plans or try a shared 5G German proxy.