I almost was going to point it out as evidence there was thought put into it. Nope, it's flimsy and AI generated.
Also, it contains provisions for scamming customers:
> 403 indicates the payment succeeded but access is denied by policy
No, it doesn't explain how to refund payments for customers you deny access to.
> Servers MAY return 402 when:
> * Offering optional paid features or premium content
This implies that a successful GET request to a resource that user already does have access to, might still return 402 instead of 200. This makes 402 basically unworkable.
Are you open to contributing to this RFC?
Am the primary author of the core spec, alongside many others at Tempo and Stripe [0].
As is customary with the IETF draft process, this is our first submission and we expect that we will continue to iterate with the broader community -- including yourself if you are interested in contributing [1]
Thanks for feedback on those two points.
Re: Refunds: This is a payment method specific implementation detail. e.g. this looks very different on cards vs. bank accounts vs. stablecoins. We will provide stronger guidance here to remove ambiguity in the spec
Re: 403: This provision comes from the ability to have _multiple_ Authentication headers, which we view as a necessity for real-world utilization and also compatibility with the Authentication scheme. Similar to the above, we will provide stronger guidance for servers which may support a plurality of authentication schemes and need to handle this edge case.
[0] Had to create a new account since it turns out many years ago I never set an email on my HN profile...
On topic though, Stripe is trying to make themselves the Visa/Mastercard of crypto. They're in position to do so and it seems like Coinbase is their other half. I don't trust or like it though.
Every time I see one of these I think "You are just describing an API".
there's nothing wrong with calling this a protocol. the problem is in hyping it up as though every protocol is going to be world-changing on the level of TCP.
MCP was just a glorified way of tool calling but generated so much hype (and it eventually died down). Now we have MPP. Which again - could have just been another tool call exposed to the agent.
Imagine you hire someone who claimed to have invented a new protocol and you're thinking of something like TCP or UDP, but all they share is just a markdown file.