Add alternate payment credential headers

[raubrey-stripe]

When using MPP in conjunction with traditional Auth schemes that use the Authorization header (like an API Key riding in Authorization: Bearer sk_...) there are conflicts - namely, Authorization header does not support multiple values.

I'm proposing a change to the MPP challenge that indicates in the WWW-Authenticate response header what request header the client should put the payment challenge into.

Proposed new header field in challenge

  HTTP/1.1 402 Payment Required
  WWW-Authenticate: Payment id="pay_abc123",
    realm="api.example.com",
    method="tempo",
    intent="charge",
    // This guy says you should not use the default Authorization header, but instead use Payement-Authorization
    header="Payment-Authorization", 
    request="eyJhbW91bnQiOiIxMDAwIn0"

If header is not included, the challenge should be included in the Authorization header.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/mppx@821

commit: 410a9c5

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b1c70e84b5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[raubrey-stripe]

@brendanjryan incorporated your feedback to get the the nil --> Authorization bits! I also have attempted to upstream this in the spec: tempoxyz/mpp-specs#328