Metered API access with no account, no API key, and nothing stored about you.
Charging for an API normally means signup, an API key, a balance in a table, and a billing relationship. Every one of those is a row about you that somebody has to keep, secure, and eventually hand over. L402 replaces the lot with a credential that carries its own limits.
Everything here runs in this tab: a real signed testnet BOLT-11 invoice, a macaroon built from an HMAC-SHA256 chain, and verification of both. No server, no node, no wallet. The one thing that genuinely needs a Lightning node is routing an actual payment, and this page is explicit about simulating that step rather than pretending otherwise.
The server answers 402 and hands back two things: an invoice to pay, and a credential that is useless until you do.
Paying a Lightning invoice reveals its preimage, and only paying does. The preimage hashes to the payment hash written into the credential, so presenting both proves payment without the server needing any record of you.
The credential says what it permits. The server checks the chain, checks the caveats, and serves. It holds one counter keyed by the payment hash and nothing else, so there is no account and no profile, but calls made are still counted.
Anyone holding a credential can narrow it and pass the narrowed copy to someone else, with no help from the server. Below, a subcontractor is given a copy capped far lower than yours. Then they try to undo it, two different ways, and the two attempts fail for two different reasons.
One integer, keyed by a payment hash: how many calls have been made against it. No name, no email, no card, no address, and no account to breach because there is no account. Two purchases by the same person look like two strangers unless they choose to reuse a credential. What has to hold is narrow: the root key stays secret, and Lightning reveals the preimage only on payment.
Implemented: macaroon minting, attenuation and verification over an HMAC-SHA256 chain; caveat evaluation; BOLT-11 invoice construction on testnet with a real recoverable signature, plus decoding and payee-key recovery; and preimage-to-payment-hash proof. Not implemented: routing a payment over Lightning, third-party caveats and their discharge macaroons, and invoice expiry handling. The invoice is a genuine testnet BOLT-11 and decodes in any Lightning tool, but no node is contacted and no payment is made, so this page cannot move a satoshi on any network.