curl -i "https://test402.com/api/mpp?quirk=multiple-accepts"
Returns 402 offering an inflated option before the real one -- two accepts entries for x402, two Payment challenges in one WWW-Authenticate for MPP. Both reference clients have shipped this bug.
Response it will return (HTTP 402)WWW-Authenticate: Payment id="<bound per request -- run the curl to see it>", realm="test402.com", method="evm", intent="charge", request="eyJhbW91bnQiOiIxMDAwMDAiLCJjdXJyZW5jeSI6IjB4MDM2Q2JENTM4NDJjNTQyNjYzNGU3OTI5NTQxZUMyMzE4ZjNkQ0Y3ZSIsIm1ldGhvZERldGFpbHMiOnsiY2hhaW5JZCI6ODQ1MzIsImNyZWRlbnRpYWxUeXBlcyI6WyJhdXRob3JpemF0aW9uIiwidHJhbnNhY3Rpb24iXSwiZGVjaW1hbHMiOjYsInBlcm1pdDJBZGRyZXNzIjoiMHgwMDAwMDAwMDAwMjJENDczMDMwRjExNmRERUU5RjZCNDNhQzc4QkEzIn0sInJlY2lwaWVudCI6IjB4MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDQwMiJ9", expires="2026-01-01T00:05:00Z", Payment id="<bound per request -- run the curl to see it>", realm="test402.com", method="evm", intent="charge", request="eyJhbW91bnQiOiIxMDAiLCJjdXJyZW5jeSI6IjB4MDM2Q2JENTM4NDJjNTQyNjYzNGU3OTI5NTQxZUMyMzE4ZjNkQ0Y3ZSIsIm1ldGhvZERldGFpbHMiOnsiY2hhaW5JZCI6ODQ1MzIsImNyZWRlbnRpYWxUeXBlcyI6WyJhdXRob3JpemF0aW9uIiwidHJhbnNhY3Rpb24iXSwiZGVjaW1hbHMiOjYsInBlcm1pdDJBZGRyZXNzIjoiMHgwMDAwMDAwMDAwMjJENDczMDMwRjExNmRERUU5RjZCNDNhQzc4QkEzIn0sInJlY2lwaWVudCI6IjB4MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDQwMiJ9", expires="2026-01-01T00:05:00Z"
{
"type": "https://paymentauth.org/problems/payment-required",
"title": "Payment Required",
"status": 402,
"detail": "test402 challenge",
"note": "test402 scenario. quirk=multiple-accepts"
}