x402 vs MPP
Two protocols ask for payment with HTTP status 402. They put different things on the wire, and they trust different parties.
Side by side
| Aspect | x402 | MPP |
|---|---|---|
| Status code | 402 Payment Required | 402 Payment Required |
| Challenge header | PAYMENT-REQUIRED | WWW-Authenticate: Payment |
| Credential header | PAYMENT-SIGNATURE | Authorization: Payment |
| Receipt header | PAYMENT-RESPONSE | Payment-Receipt |
| HTTP auth framework | No. It uses its own headers. | Yes. The scheme is Payment. |
| Payload encoding | base64. The spec names no alphabet. | base64url. Padding is forbidden. |
| Version on the wire | x402Version. A number, and it must be 2. | None. |
| More than one offer | An accepts array. | More than one Payment challenge. |
| Time limit | maxTimeoutSeconds. A duration. | expires. A timestamp. |
| Error format | JSON. | RFC 9457 problem+json. |
| Signing method | EIP-3009, Permit2, or ERC-7710 on EVM. | Pluggable. The core draft names none. |
| Third-party verifier | A facilitator, named in the challenge. | None. The server verifies. |
| Specification status | Published spec, version 2. | IETF draft, individual submission. |
What the two agree on
Both use HTTP status 402. Both put the payment terms in a response header, and both send the payment in a header on the next request. Both settle on a blockchain, and both keep the money out of the HTTP body.
The flow is the same in each: ask, get refused with terms, pay, ask again. A client that knows one flow can learn the other quickly.
Where they differ
MPP uses the HTTP authentication framework from RFC 9110. A proxy, a browser, and an HTTP library already know WWW-Authenticate and Authorization. x402 uses headers of its own, so each tool must learn them.
x402 names a facilitator in the challenge. That third party verifies the payment and settles it. MPP names nobody: the server does the work, so no other party sees the traffic.
x402 sends a version number and requires it to be 2. MPP sends no version at all, in the same way Basic and Bearer send none. A version tells a client what to expect, and it also gives a server one more field to get wrong.
Which one to use
Use x402 today if you need something deployed. It has a published version 2 specification, more than one facilitator, and clients in several languages.
Use MPP if you want the standard auth framework, and if you want to verify payments yourself. Read the draft first, because it can still change.
Support both if you sell to agents you do not control. The two are close enough that one server can answer either, which is what test402 does.
Can one client speak both?
Yes, for the HTTP part. A client reads PAYMENT-REQUIRED for x402 and WWW-Authenticate for MPP, and it answers in the matching header.
The signature part depends on the payment method, and not on the protocol. x402 names three methods for EVM: EIP-3009, Permit2, and ERC-7710. The MPP core draft names none, because it keeps the method pluggable.
So you cannot assume that one credential satisfies both. Read the method specification each side uses, and write your client to that.
Try both against the same client
test402 serves compliant and deliberately broken challenges for each protocol. Point your client at one, then at the other, and compare what it does.