HTTP's 418 "I'm a teapot" error comes from RFC 2324, a 1998 April Fools' coffee pot protocol with a WHEN command to stop the milk

The joke opens like a real standard, which is what makes it work. “There is coffee all over the world,” the rationale begins. “Increasingly, home and consumer devices are being connected to the Internet.” Masinter cites the real history to back it up: a Coke machine wired up “for status monitoring,” and an Internet Toaster that “was debuted in 1990.”

Then it gets to the commands. A coffee pot server “MUST accept both the BREW and POST method equivalently,” because, as the RFC puts it, “POST may be a trademark for coffee, and so the BREW method has been added.”

The WHEN method is the one that gives the game away. The RFC explains that when milk is being poured, “it is necessary for the holder of the recipient of milk to say “when”,” and it signs off the section with “Enough? Say WHEN.”

The add-ins are spelled out in the grammar like any other HTTP header. There’s an Accept-Additions header with milk types from “Cream” to “Half-and-half,” and an alcohol type limited to “Whisky,” “Rum,” “Kahlua” or “Aquavit.” Decaf gets one line: “No options were given for decaffeinated coffee. What’s the point?”

And then section 2.3.2, the one everybody remembers. “Any attempt to brew coffee with a teapot should result in the error code “418 I’m a teapot”. The resulting entity body MAY be short and stout.”

The URL scheme goes international. Coffee URLs are written in “the word for “coffee” in any of 29 languages,” and the RFC notes that “capitalization is important for German and thus the initial “K” must be encoded,” which is how “%4Baffee” ended up in an IETF document.

The security section is two sentences of puns stacked on a real point: “Anyone who gets in between me and my morning coffee should be insecure.” It warns of “denial of coffee service” attacks and says filtration devices “might admit trojan grounds.”

That last point is in writing. RFC 9110, the June 2022 rewrite of HTTP’s semantics, gives the code its own section titled “418 (Unused).” It says the teapot code “has been deployed as a joke often enough for the code to be unusable for any future use,” and so it’s “reserved in the IANA HTTP Status Code Registry.” It can be handed out again only if things like the “exhaustion of 4NN status codes” ever force it.

The teapots even got their own follow-up. RFC 7168, another April 1 document, from Imran Nazar in 2014, added HTCPCP-TEA “to allow for pots to provide networked tea-brewing facilities.” A tea pot that can’t brew coffee may answer 503, for coffee that’s temporarily unavailable, or 418, as “a more permanent indication that the pot is a teapot.”

What these RFCs have going for them is that they’re readable. All three are on the IETF’s site, sourced here from the documents themselves rather than anyone’s retelling, and RFC 2324 runs ten pages.

The firewall advice still stands, in capital letters: “Every home computer network SHOULD be protected by a firewall from sources of heat.”