One byte

There is only one wire for each direction of data, so a byte cannot go out all at once. It goes as eight bits in a row, one on each tick of SCK.

In what order

The usual order is most significant bit first. Take 0xA5, which is 1010 0101 in binary. The first bit on the wire is the leftmost one, a 1, then 0, then 1, and the last is the rightmost bit. The datasheets of the W25Q128 flash and of the BME280 sensor both send and expect their bytes this way, and it is the default in ESP-IDF.

A few chips want least significant bit first. The Arduino SPISettings takes MSBFIRST or LSBFIRST, and ESP-IDF has flags to flip the transmit and receive order separately. Neither order is more correct than the other. The datasheet of the peripheral decides, and it decides for that part alone.

Which end is which

The bit that goes first is the one the receiver shifts in first, and it ends up furthest along its register once eight bits have arrived. A receiver that reads in the opposite order arrives at the same eight bits reversed: 0xA5 is symmetrical and would hide the mistake, but 0x01 becomes 0x80.

There is no marker on the wire that says which order was meant, and no marker that says where a byte begins. The eight ticks are the byte.

What it costs

A wrong order is not an error. Every byte arrives complete and every one is wrong, in a regular way that looks like a fault somewhere else: a command the chip ignores, a register that seems to hold the wrong value. On a logic analyser the trace reads correctly if you read it the other way round, which is how it is usually found.

Common mistakes

• Assuming LSB first because a library said so once. Check the datasheet for the part in front of you.
• Testing with a symmetrical byte. 0xA5 and 0x81 look right both ways round. Use 0x01.
• Reversing the bits in software and in the driver. Two flips make one no-op, and a hard bug to see.