> **Can't find what you're looking for?** Use `search_docs` on the docs MCP server at `https://mpp.dev/api/mcp` to find what you need.

# Expanding identity support in mppx \[Verify agent identity through the lifecycle of a payment]

[`mppx`](/sdk/typescript) now lets agents use protocols such as [Web Bot Auth](https://datatracker.ietf.org/doc/html/draft-meunier-http-message-signatures-directory-03) and the [Trusted Agent Protocol](https://developer.visa.com/capabilities/trusted-agent-protocol/trusted-agent-protocol-specifications/) to identify themselves to downstream services. Agent identity travels with the request, including automatic MPP retries, so servers can apply their own trust and access policies. MPP leaves the choice of identity protocol to the application and is extensible by design to support a multitude of identity protocols alongside the core payment flow.

## Signed identity on every request

When configured, the `mppx` agent SDK signs the initial request and each paid retry using [RFC 9421 HTTP Message Signatures](https://www.rfc-editor.org/rfc/rfc9421). Each [request identity proof](/extensions/identity#agent-signatures) carries a fresh timestamp and nonce, and the server verifies it before issuing a Challenge or accepting a Credential.

The first two request identity profiles implemented in `mppx` are:

* **[Web Bot Auth](https://datatracker.ietf.org/doc/html/draft-meunier-web-bot-auth-architecture)** identifies an automated client through a signed `Signature-Agent` value and a trusted HTTPS directory.
* **[TAP](https://developer.visa.com/capabilities/trusted-agent-protocol/trusted-agent-protocol-specifications/)** carries agent identity and `browse` or `payment` intent from a trusted provider.

### Agents

On the client, configure Web Bot Auth, TAP, or both through [`Mppx.create`](/sdk/typescript/client/Mppx.create):

:::code-group
```ts [Web Bot Auth]
import { Mppx, tempo } from 'mppx/client'
import * as WebBotAuth from 'mppx/extensions/identity/web-bot-auth'

const client = Mppx.create({
  identity: [
    WebBotAuth.Client.prover({
      key: webBotAuthPrivateKey,
      keyId: webBotAuthKeyId,
      scope: ['https://api.example.com'],
      signatureAgent: 'https://bot.example',
    }),
  ],
  methods: [tempo({ account })],
  polyfill: false,
})
```

```ts [TAP]
import { Mppx, tempo } from 'mppx/client'
import * as Tap from 'mppx/extensions/identity/tap'

const client = Mppx.create({
  identity: [
    Tap.Client.prover({
      intent: 'payment',
      key: tapPrivateKey,
      keyId: tapKeyId,
      scope: ['https://merchant.example'],
    }),
  ],
  methods: [tempo({ account })],
  polyfill: false,
})
```
:::

### Servers

The server creates matching verifiers and requires one accepted protocol on each protected route. Each verifier resolves keys from an application-selected trust source. The [generic identity framework](/extensions/identity#build-your-own-protocol) also supports third-party identity protocols through its lower-level Client and Server APIs.

```ts [server.ts]
import * as Tap from 'mppx/extensions/identity/tap'
import * as WebBotAuth from 'mppx/extensions/identity/web-bot-auth'
import { Mppx, tempo } from 'mppx/server'
import * as Identity from 'mppx/identity'

const tap = Tap.Server.verifier({
  keyResolver: resolveTapKey,
  nonceStore,
})
const webBotAuth = WebBotAuth.Server.verifier({
  keyResolver: resolveWebBotAuthKey,
  nonceStore,
})

const server = Mppx.create({ methods: [tempo.charge()] })

export const handler = server.charge({ amount: '1', identity: [Identity.anyOf(tap, webBotAuth)] })
```

## Extensible identity

`mppx` was built around a protocol-neutral, extensible [identity framework](/extensions/identity#build-your-own-protocol). Web Bot Auth and TAP are the first supported profiles, but more can be added with a Client prover and matching Server verifier from `mppx/identity`. Each profile can carry identity on the initial HTTP request and every automatic MPP retry. The Server verifies the result for application policy, while the MPP payment flow stays unchanged.

## Learn more

* [Web Bot Auth](https://datatracker.ietf.org/doc/html/draft-meunier-http-message-signatures-directory-03)
* [Trusted Agent Protocol (TAP)](https://developer.visa.com/capabilities/trusted-agent-protocol/trusted-agent-protocol-specifications/)
* [Identity in MPP](/extensions/identity)