# HTTP transport \[Payment flows using standard HTTP headers]
The HTTP transport is the primary binding for MPP, using standard HTTP headers from [RFC 9110](https://www.rfc-editor.org/rfc/rfc9110#section-11).
## Headers
| Direction | Header | Purpose |
|-----------|--------|---------|
| Server → Client | `WWW-Authenticate: Payment ...` | Challenge |
| Client → Server | `Authorization: Payment ...` | Credential |
| Server → Client | `Payment-Receipt: ...` | Receipt |
## Example flow
:::steps
### Client
Request a resource
```http
GET /api/data HTTP/1.1
Host: api.example.com
```
### Server
Send a payment challenge
Return the `WWW-Authenticate` header with a `Payment` challenge.
```http
HTTP/1.1 402 Payment Required
WWW-Authenticate: Payment id="abc123", method="tempo", intent="charge", request="..."
```
### Client
Retry with a credential
Send the `Authorization` header.
```http
GET /api/data HTTP/1.1
Host: api.example.com
Authorization: Payment eyJjaGFsbGVuZ2UiOnsiaWQiOiJhYmMxMjMi...
```
### Server
Return a receipt
Return the `Payment-Receipt` header with a success receipt.
```http
HTTP/1.1 200 OK
Payment-Receipt: eyJzdGF0dXMiOiJzdWNjZXNzIi4uLn0
Content-Type: application/json
{"data": "..."}
```
:::
## Header encoding
Challenges are encoded as [auth-params](https://www.rfc-editor.org/rfc/rfc9110#section-11.2) in `WWW-Authenticate`. Credentials and receipts use base64url-encoded JSON.
## Full specification