L402 primary sources — 2026-05-02

Project status in this pass

• No separate standalone L402 whitepaper or litepaper surfaced.
• The clearest current source of truth is the L402 docs site, the Lightning Labs README and protocol specification, the authentication-flow docs, and Lightning Engineering’s builder guide.
• The materials consistently frame L402 as a paid-API and payment-authentication standard rather than as only a Lightning Labs product or a single reverse-proxy implementation.

Primary-source snapshots

1) L402 docs site

• URL: https://docs.l402.org/
• Key excerpt:
  • The docs site frames L402 as the “Missing Link in Internet Payment Infrastructure.”
  • It says L402 standardizes how payments are requested directly within HTTP interactions using HTTP 402 responses and JSON payloads.
  • It also emphasizes automation, payment-method flexibility, and AI-agent or machine-friendly usage.

2) Lightning Labs README

• URL: https://raw.githubusercontent.com/lightninglabs/L402/master/README.md
• Key excerpt:
  • The README calls L402 an open protocol for paying for and authenticating access to APIs and services over the internet using the Lightning Network.
  • It shows the core handshake: WWW-Authenticate: L402 macaroon="...", invoice="..." followed by Authorization: L402 <macaroon>:<preimage>.
  • It also highlights no-accounts/no-passwords access, pay-as-you-go API usage, programmable credentials, stateless verification, and agentic-commerce fit.

3) Protocol specification

• URL: https://raw.githubusercontent.com/lightninglabs/L402/master/protocol-specification.md
• Key excerpt:
  • The specification says L402 combines HTTP 402 Payment Required with Lightning invoice payments to create a challenge-response protocol for paid API access.
  • It defines the credential as a macaroon plus preimage pair and says the macaroon commits to the invoice payment hash, enabling stateless verification.
  • It also specifies HTTP and gRPC behavior, including 402 challenges for HTTP and gRPC trailing-header handling for payment-gated requests.

4) Authentication flow guide

• URL: https://raw.githubusercontent.com/lightninglabs/L402/master/docs/authentication-flow.md
• Key excerpt:
  • The authentication-flow docs say users can obtain API-like credentials without account creation or personal-information entry.
  • They describe the lifecycle from first request, invoice generation, and macaroon minting through Lightning payment, credential storage, and automatic reuse on later requests.
  • The guide makes clear that the whole point is frictionless paid access for client software, not a manual web checkout experience.

5) Lightning Engineering builder guide

• URL: https://docs.lightning.engineering/the-lightning-network/l402
• Key excerpt:
  • The builder guide calls L402 a standard for authentication and trade of services such as API endpoints and computational resources, with a focus on agentic commerce.
  • It says the endpoint can verify payment statelessly and that bearer tokens can be passed on and attenuated for narrower permissions.
  • It also points to Aperture as an implementation, reinforcing that L402 is a protocol with implementations rather than the implementation itself.

Working conclusion

L402 is best cataloged as HTTP-native payment-authentication infrastructure for paid APIs and machine commerce. The deciding evidence in this pass was the repeated combination of HTTP 402 challenge semantics, Lightning invoice payment, macaroon-plus-preimage credentials, stateless verification, delegation/attenuation, and explicit positioning around AI agents and automated services.