Question: issuer shared_metadata support for Link SPT requests
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 42/100
- Issue type
- Feature
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- typescript
Research direction
Start by reviewing the Link shared payment token API and the MPP challenge and Stripe reference implementation linked in the issue. Determine whether Link supports requesting issuer-visible shared_metadata, and compare that with the existing sandbox observation. Done means documenting the supported capability and the recommended integration for challenge binding and merchant-side order association.
Written by the indexing model from the issue text.
Description
Clarification: optional issuer metadata support, not an established MPP defect
After rechecking the current MPP specifications and reference implementation, we need to correct our original framing. Requiring shared_metadata[ticket_fairy_request_binding] is an additional Ticket Fairy application contract, not a demonstrated requirement of Stripe MPP. We have not established a Stripe or Link protocol defect.
Standard MPP authenticates the echoed challenge (including payment parameters and optional expiry/body digest/opaque context), and the Stripe reference implementation settles the exact challenge amount/currency with the SPT and a challenge/token idempotency key. It does not require a granted-token shared_metadata lookup. The server-authenticated challenge and issuer attestation of a specific purchase are different assurances; our implementation had demanded the latter as an extra condition.
The sandbox observation below remains reproducible, but should be treated as a capability question:
- Official @stripe/link-cli 0.29.2, one explicitly test-mode SPT request, existing test seller Profile, amount 100 USD minor units.
- Explicit SpendRequest metadata
ticket_fairy_request_binding=<opaque test reference>was retained on the approved SpendRequest. - The seller retrieved that exact granted token: HTTP 200, object
shared_payment.granted_token, livemode false, empty shared_metadata. - No token was consumed and no PaymentIntent, live charge or transfer was created.
Does Link offer a supported way to request issuer-visible shared_metadata, or is the recommended integration to rely on the standard challenge/body binding and merchant-side order association instead? We are reviewing our additional restriction for interoperability rather than asking Link to satisfy a supposed protocol mandate.
Sources:
- https://paymentauth.org/draft-httpauth-payment-01.txt
- https://paymentauth.org/draft-stripe-charge-00.pdf
- https://github.com/wevm/mppx/blob/main/src/stripe/server/Charge.ts
- https://docs.stripe.com/api/shared-payment/issued-token/create
No credentials, tokens, customer data or account identifiers are included.
- Dominant language
- TypeScript
- Stars
- 885
- Forks
- 156
- Avg merge
- 23h 49m
- Merged PRs (30d)
- 79
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from stripe/link-cli
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
Maintainers usually reply within 1 day
-
JumaOpen
Difficulty 5/5 Over a week Newbie friendliness 1/100
Maintainers usually reply within 1 day
-
123Open
Difficulty 5/5 Over a week Newbie friendliness 10/100
Maintainers usually reply within 1 day
-
1234Open
Difficulty 5/5 Over a week Newbie friendliness 1/100
Maintainers usually reply within 1 day
-
`balances list` renders non-USD balances with a `$` symbol and a fixed `/100`Possibly taken @RaphaelFakhri claimed this 8 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 25/100
Maintainers usually reply within 1 day
Similar issues
-
docker infra P1 security size:S
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
josephfung/curia#2408 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
ehmpathy/rhachet-roles-ehmpathy#1231 ·
Maintainers usually reply within 1 day
-
enhancement good first issue help wanted
Difficulty 2/5 Half a day Newbie friendliness 70/100
danielw-sudo/agentuto#32 ·
Maintainers usually reply within 1 day
-
type:docs
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
nightgauge/nightgauge#2836 ·
Maintainers usually reply within 1 day