Skip to content

spec: add challenge-binding secret guidance#233

Open
brendanjryan wants to merge 1 commit intomainfrom
brendan/add-challenge-binding-secret-guidance
Open

spec: add challenge-binding secret guidance#233
brendanjryan wants to merge 1 commit intomainfrom
brendan/add-challenge-binding-secret-guidance

Conversation

@brendanjryan
Copy link
Copy Markdown
Collaborator

Summary

  • add an implementation-agnostic security note for stateless challenge-binding secrets
  • clarify that shared secrets stay server-side and out of logs
  • recommend overlap during secret rotation so unexpired challenges remain valid

Testing

  • not run (markdown-only spec change)

@github-actions
Copy link
Copy Markdown

github-actions bot commented Apr 13, 2026

Spec Preview

Spec Changed Artifacts
draft-card-charge-00 - HTML · TXT · XML · PDF
draft-httpauth-payment-00 Yes HTML · TXT · XML · PDF
draft-lightning-charge-00 - HTML · TXT · XML · PDF
draft-lightning-session-00 - HTML · TXT · XML · PDF
draft-payment-discovery-00 - HTML · TXT · XML · PDF
draft-payment-intent-charge-00 - HTML · TXT · XML · PDF
draft-payment-transport-mcp-00 - HTML · TXT · XML · PDF
draft-solana-charge-00 - HTML · TXT · XML · PDF
draft-stellar-charge-00 - HTML · TXT · XML · PDF
draft-stripe-charge-00 - HTML · TXT · XML · PDF
draft-tempo-charge-00 - HTML · TXT · XML · PDF
draft-tempo-session-00 - HTML · TXT · XML · PDF

Browse preview release assets

Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9b876e6d96

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".


| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `methodDetails.chainId` | number | OPTIONAL | Tempo chain ID. If omitted, the default value is 4217 (Tempo mainnet). |
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Keep Tempo chainId default consistent across method drafts

This draft sets the implicit methodDetails.chainId default to 4217, but existing Tempo method specs still default to 42431 (see specs/methods/tempo/draft-tempo-charge-00.md line 154 and specs/methods/tempo/draft-tempo-session-00.md line 543). When clients omit chainId and reuse shared Tempo defaults, subscription credentials will be signed/validated on a different chain than charge/session flows, causing verification failures or settlement on an unintended network; the default should be aligned or made explicitly required here.

Useful? React with 👍 / 👎.

@brendanjryan brendanjryan force-pushed the brendan/add-challenge-binding-secret-guidance branch from 9b876e6 to 5d1feb2 Compare April 13, 2026 22:34
@brendanjryan brendanjryan enabled auto-merge (squash) April 15, 2026 02:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant