# Challenges \[Server-issued payment requirements] Your server issues a **challenge** to describe the payment required for a resource. Send challenges in the `WWW-Authenticate` header using the `Payment` authentication scheme. ## Structure ```http WWW-Authenticate: Payment id="qB3wErTyU7iOpAsD9fGhJk", realm="mpp.dev", method="tempo", intent="charge", expires="2025-01-15T12:05:00Z", request="eyJhbW91bnQiOiIxMDAwIiwiY3VycmVuY3kiOiJ1c2QifQ" ``` ### Required parameters | Parameter | Description | |-----------|-------------| | `id` | Unique challenge identifier, cryptographically bound to challenge parameters | | `realm` | Protection space identifier (typically the API domain) | | `method` | Payment method identifier (such as `tempo` or `stripe`) | | `intent` | Payment intent type (such as `charge` or `authorize`) | | `request` | Base64url-encoded JSON with payment details | ### Optional parameters | Parameter | Description | |-----------|-------------| | `expires` | ISO 8601 timestamp when the challenge expires | | `description` | Human-readable description of what's being paid for | ## `request` object The `request` parameter contains method-specific payment details encoded as base64url JSON: ```json [Decoded request object] { "amount": "1000", "currency": "usd", "recipient": "0xa726a1CD723409074DF9108A2187cfA19899aCF8" } ``` Common fields across payment methods: | Field | Description | |-------|-------------| | `amount` | Payment amount in base units (for example, cents for USD) | | `currency` | Currency code (`usd`) or token address (`0x20c0...`) | | `recipient` | Payment destination in method-native format | ## Multiple challenges Servers can offer multiple payment options in a single response: ```http HTTP/1.1 402 Payment Required WWW-Authenticate: Payment id="abc", method="tempo", ... WWW-Authenticate: Payment id="def", method="stripe", ... ``` Clients select one based on their capabilities and submit a single credential. ## Challenge binding :::warning\[Security requirement] Challenges must be cryptographically bound to their parameters through the `id` field. This prevents clients from reusing a challenge ID with modified payment terms. ::: Typical binding includes: * `realm`, `method`, `intent` * Hash of the `request` object * `expires` timestamp Use an [HMAC-bound](https://en.wikipedia.org/wiki/HMAC) challenge ID to prevent clients from reusing a challenge ID with modified payment terms. ## Learn more