---
title: "MPP challenge with no realm — x402 defect class mpp-challenge-realm"
description: "MPP challenge with no realm (mpp-challenge-realm), an x402 defect class: Every Payment challenge names its realm, the RFC 9110 protection space. Detectable by an unpaid probe. A client cannot scope a credential to the door that asked for it; some clients refuse, others send credentials where they were not asked for."
canonical: "https://scvd.store/defects/mpp-challenge-realm"
url: "https://scvd.store/defects/mpp-challenge-realm"
term_code: "mpp-challenge-realm"
defined_in: "https://scvd.store/defects"
data: "https://scvd.store/defects.json"
vocabulary_version: "22"
license: "https://creativecommons.org/licenses/by/4.0/"
---

# MPP challenge with no realm

`mpp-challenge-realm` — an x402 defect class.

**Asserts:** Every Payment challenge names its realm, the RFC 9110 protection space.

**Costs:** A client cannot scope a credential to the door that asked for it; some clients refuse, others send credentials where they were not asked for.

**Detectable:** unpaid — a free probe can see it

**Falsified by:** The same challenge carrying a realm at the stated moment.

**How an operator clears it:** Set realm to your door's protection space — usually your host — on every challenge; the auth-scheme grammar requires it.

**What a buyer does:** Treat a challenge with no realm as unscoped: do not reuse a credential across doors, and prefer a door whose challenge names where the credential belongs.

**Our signal:** `mpp-challenge-realm`

---

Vocabulary v22, CC BY 4.0. Every class: https://scvd.store/defects. Machine-readable, with falsifiers and cross-instrument mappings: https://scvd.store/defects.json.

A class describes a property of one endpoint at one moment and never accumulates into a judgment on an operator.