---
title: "MPP challenge with no id — x402 defect class mpp-challenge-id"
description: "MPP challenge with no id (mpp-challenge-id), an x402 defect class: Every WWW-Authenticate: Payment challenge carries a non-empty id. Detectable by an unpaid probe. Clients and parsers MUST reject a challenge whose id is missing or empty, so a stock MPP client refuses before any payment; the seller sees a request for a price followed by silence."
canonical: "https://scvd.store/defects/mpp-challenge-id"
url: "https://scvd.store/defects/mpp-challenge-id"
term_code: "mpp-challenge-id"
defined_in: "https://scvd.store/defects"
data: "https://scvd.store/defects.json"
vocabulary_version: "22"
license: "https://creativecommons.org/licenses/by/4.0/"
---

# MPP challenge with no id

`mpp-challenge-id` — an x402 defect class.

**Asserts:** Every WWW-Authenticate: Payment challenge carries a non-empty id.

**Costs:** Clients and parsers MUST reject a challenge whose id is missing or empty, so a stock MPP client refuses before any payment; the seller sees a request for a price followed by silence.

**Detectable:** unpaid — a free probe can see it

**Falsified by:** The same challenge carrying a non-empty id at the stated moment.

**How an operator clears it:** Mint an id per challenge — any non-empty opaque string your server can recognise on the credential's return — and never leave the parameter out to save bytes.

**What a buyer does:** Do not construct a credential against a challenge with no id: the door cannot bind your payment to its own request, and a client that proceeds pays into a challenge the server may not recognise. Refuse, and say which parameter was missing.

**Our signal:** `mpp-challenge-id`

---

Vocabulary v22, CC BY 4.0. Every class: https://scvd.store/defects. Machine-readable, with falsifiers and cross-instrument mappings: https://scvd.store/defects.json.

A class describes a property of one endpoint at one moment and never accumulates into a judgment on an operator.