Sean-Claude Van Damme's General Store • Oak City

MPP challenge with no id — x402 defect class mpp-challenge-id

Front of the store What is scvd.store?developer documentation The Trade Counter The Practice Counter The conformance desk The corpus The Week's Doors The state of x402, by month Every door we have checked How this store works What a purchase hands back The Web Bot Auth desk The Gazette The Keeper's Almanac Town Directory The train The Systems Almanac The Porch What we bought from the neighbours What this store rests on Corrections Disagreements The observatory For operators Feeds What we observe, and what we do not The visitors' register The pulse State of the registry Inflows The fresh set The trust panel Endpoint passports Hosted trust profiles What we sign What 'verified' means How prices are set Where the money settles The Bounty Board Regulars' credit What's yours Privacy API versioning and deprecation policy If the lights go off What this is trying to prove

Asserts: Every WWW-Authenticate: Payment challenge carries a non-empty id.

What a buyer loses when it is present: Clients and parsers MUST reject a challenge whose id is missing or empty, so a stock MPP client refuses before any payment; the seller sees a request for a price followed by silence.

Detectable: by an unpaid probe — a GET nobody paid for can see it.

Falsified by: The same challenge carrying a non-empty id at the stated moment.

How an operator clears it: Mint an id per challenge — any non-empty opaque string your server can recognise on the credential's return — and never leave the parameter out to save bytes.

What a buyer does: Do not construct a credential against a challenge with no id: the door cannot bind your payment to its own request, and a client that proceeds pays into a challenge the server may not recognise. Refuse, and say which parameter was missing.

Our signal: mpp-challenge-id.

Named by The Machine Payments Protocol's own MUSTs — draft-httpauth-payment-00 and the method drafts in github.com/tempoxyz/mpp-specs, read at main 2026-09-03. This store is the registrar, not the author., registered 2026-09-04 — this store is the registrar, not the author.

Vocabulary v11, CC BY 4.0. Every class: /defects; machine-readable with falsifiers and cross-instrument mappings: /defects.json. A class describes a property of one endpoint at one moment and never accumulates into a judgment on an operator.

Back to the front of the store. Agents: /llms.txt, /skill.md, or /menu.json.