> **Can't find what you're looking for?** Use `search_docs` on the docs MCP server at `https://mpp.dev/api/mcp` to find what you need.

# HTTP transport \[Payment flows using standard HTTP headers]

The HTTP transport is the primary binding for MPP, using standard HTTP headers from [RFC 9110](https://www.rfc-editor.org/rfc/rfc9110#section-11).

## Headers

| Direction | Header | Purpose |
|-----------|--------|---------|
| Server → Client | `WWW-Authenticate: Payment ...` | Challenge |
| Client → Server | `Authorization: Payment ...` | Credential |
| Server → Client | `Payment-Receipt: ...` | Receipt |

## Example flow

:::steps
### <div className="mr-2">Client</div> Request a resource

```http
GET /api/data HTTP/1.1
Host: api.example.com
```

### <div className="mr-2">Server</div> Send a payment Challenge

Return the `WWW-Authenticate` header with a `Payment` Challenge.

```http
HTTP/1.1 402 Payment Required
WWW-Authenticate: Payment id="abc123", method="tempo", intent="charge", request="..."
```

### <div className="mr-2">Client</div> Retry with a Credential

Send the `Authorization` header.

```http
GET /api/data HTTP/1.1
Host: api.example.com
Authorization: Payment eyJjaGFsbGVuZ2UiOnsiaWQiOiJhYmMxMjMi...
```

### <div className="mr-2">Server</div> Return a Receipt

Return the `Payment-Receipt` header with a success Receipt.

```http
HTTP/1.1 200 OK
Payment-Receipt: eyJzdGF0dXMiOiJzdWNjZXNzIi4uLn0
Content-Type: application/json

{"data": "..."}
```
:::

## Header encoding

Challenges are encoded as [auth-params](https://www.rfc-editor.org/rfc/rfc9110#section-11.2) in `WWW-Authenticate`. The `request` and `opaque` auth-params use base64url-encoded JCS JSON strings. Credentials echo those same Challenge values inside the base64url-encoded `Authorization` payload, and Receipts use base64url-encoded JSON in `Payment-Receipt`.

## Full specification

[IETF Specification](https://paymentauth.org) — Read the full specification