Challenge.from

Creates a Challenge from the given parameters.

If secretKey option is provided, the Challenge ID is computed as HMAC-SHA256 over the Challenge parameters (realm|method|intent|request|expires|digest|opaque), cryptographically binding the ID to its contents. When expires, digest, or opaque is absent, that slot is an empty string.

Load secretKey from your server environment or secret manager. Do not ship it to clients.

Usage

import { Challenge } from 'mppx'
 
const secretKey = process.env.MPP_SECRET_KEY!
 
// With HMAC-bound ID (recommended for servers)
const challenge = Challenge.from(
  {
    intent: 'charge',
    method: 'tempo',
    realm: 'mpp.dev',
    request: { amount: '1000000', currency: '0x...', recipient: '0x...' },
    secretKey,
  },
)

With explicit ID

Use an explicit ID when you don't need HMAC-bound Challenge verification.

import { Challenge } from 'mppx'
 
const challenge = Challenge.from({
  id: 'abc123',
  intent: 'charge',
  method: 'tempo',
  realm: 'mpp.dev',
  request: { amount: '1000000', currency: '0x...', recipient: '0x...' },
})

Return type

type ReturnType = Challenge

A Challenge object.

Parameters

description (optional)

• Type: string

Human-readable description of the payment.

digest (optional)

• Type: string

Digest of the request body.

expires (optional)

• Type: string

Expiration timestamp (ISO 8601).

id (when not using secretKey)

• Type: string

Explicit Challenge ID.

intent

• Type: string

Intent type (for example, "charge", "session").

meta (optional)

• Type: Record<string, string>

Server-defined correlation data. mppx serializes it as the base64url-encoded opaque auth-param in HTTP Challenges.

method

• Type: string

Payment method (for example, "tempo", "stripe").

parameters

Challenge parameters. Must include either id or secretKey.

realm

• Type: string

Server realm (for example, hostname).

request

• Type: Record<string, unknown>

Method-specific request data. mppx serializes it as base64url-encoded JCS JSON in the HTTP request auth-param.

secretKey (when not using id)

• Type: string

Server secret for HMAC-bound Challenge ID. Keep it server-side and load it from your environment or secret manager.