x401 is the reason your AI agent may soon carry ID. On October 15, 2026, Boston-based Proof launched x401, an open protocol that lets any website ask an AI agent who it represents — and demand cryptographic proof of what that person actually approved.
Weeks earlier, Amazon blocked Meta’s Muse agent from its marketplace over exactly this problem: no reliable way to know who an agent acts for. x401 is Proof’s answer, built to work alongside x402, the Linux Foundation’s payment protocol.
As Proof founder and CEO Pat Kinsel put it: “Businesses are being asked to accept instructions from software acting for a customer, but they cannot reliably prove who that customer is or what the customer approved.”
What x401 actually does
x401 extends HTTP 401 — the web’s standard “unauthorized” response. A protected endpoint answers with a PROOF-REQUIRED header naming the evidence required: verified identity claims plus a cryptographic signature on the transaction terms.
The agent shows the request to its human, who approves with a biometric on their own device. The hardware-protected key signs the presentation, binding verified legal identity to the precise terms. The website verifies everything and keeps the signed evidence — alter any signed term and the signature fails.
What’s live today
Three capabilities launched together:
| Capability | What it does | Status |
|---|---|---|
| Agent identity wallet | Shows requested info and terms; biometric approval on the user’s device | Live |
| x401 protocol | Open HTTP protocol for requesting and verifying identity evidence (v0.1.0) | Live |
| Production MCP server | Works with Meta’s Muse, ChatGPT dots, Grok, Claude, and other MCP assistants | Live |
Stat highlights from Proof’s official materials:
- $1T+ — transactions secured on Proof’s platform (launch announcement)
- 8,000+ — businesses in Proof’s identity network (proof.com)
- 57% — web-page requests from bots, passing humans for the first time (Cloudflare, June 2026, via announcement)
- 7,851% — AI-agent traffic growth in 2025 (HUMAN Security, via announcement)
- 31% / 51% — US consumers who won’t let agents spend / won’t let agents store card details (Exploding Topics, n=1,000, via announcement)
The four-node delegation chain
The spec defines four nodes, each with a verifiable artifact — remove one and the transaction can’t proceed. A human verifies once at NIST IAL2, then signs a scoped mandate: which agent, merchant, action, amount ceiling, time window. The agent presents via OpenID4VP and can’t exceed scope. The merchant verifies independently — then 200 OK.
How an x401 handshake works
1. Human
IAL2-verified via biometric + government ID. Holds a verifiable credential in a cloud wallet.
2. Signed mandate
Signs the scope: which agent, which merchant, what action, amount ceiling, time window.
3. Agent presents
Presents the credential via OpenID4VP. Anything outside the mandate is rejected.
4. Merchant verifies
Verifies identity, scope, and signature independently — then 200 OK.
x401 meets x402
Agents transacting need three things: who’s behind the agent, what they authorized, and how it gets paid. x401 covers the first two; x402 — the Linux Foundation’s HTTP-native payment protocol (40+ members: Visa, Mastercard, Stripe, Google, AWS, Circle, Coinbase) — covers payment.
Proof uses x402 itself: websites pay per identity claim with no purchase order — identity metered like bandwidth. Under the hood: Kantara-certified IAL2 proofing, X.509 certs from a WebTrust-audited CA, FIPS 140-2 L3 HSMs, and interop with AP2 and Verifiable Intent.
September FinCEN guidance recognized digital certificates and verifiable credentials as permissible identity verification. First published June 2026 with Visa, Circle, and Okta contributing, the spec lives at proof.com/x401 — Superfluid ran the first live implementation in September.
How to profit from x401
Open protocols create land grabs. Here’s where the money is:
- Sell “agent-ready” storefront upgrades. The reference implementation targets Cloudflare Workers, with guides for Node, Python, and Go — package x401 checkout integration for Shopify and WooCommerce stores as a fixed-price service.
- Pitch trust as conversion. 51% of consumers won’t let agents hold card details — “verified agent checkout” is a differentiator merchants pay for.
- Prototype at near-zero cost. Per-claim metering over x402 with no enterprise contract means a working client demo in an afternoon, starting at proof.com/x401.
- Target regulated verticals. Banks, lenders, and insurers need the evidentiary trail — wires, payment mandates, and itemized purchases are documented use cases.
- Create early-mover content. The spec is open, governance is still forming, and Proof demos at Money20/20 October 18–21 — explainers published now rank before the wave.
FAQ
Is x401 a Proof product or truly open?
Open. Proof published the full spec and intends neutral governance. Any CA can issue conformant credentials; Proof is the primary implementer.
How is x401 different from x402?
x401 proves who is behind the request and carries signed evidence of what they approved; x402 moves the payment. Designed to work together: identity over x401, settlement over x402.
Which AI assistants work with it?
Meta’s Muse, ChatGPT dots, Grok, Claude, and other MCP assistants via Proof’s production server. Consumers enroll when a credential is first requested.
What does verification cost a website?
Per-claim pricing over x402 — no sales process, no minimum. Basic claims like verified age, country, and email need no contract at all.
Isn’t this just a login with extra steps?
No. A login proves access; x401 binds a verified legal identity to one transaction’s signed terms — evidence that survives a dispute even if the agent misbehaves.
Where do developers start?
proof.com/x401 has the protocol, scheme, and reference implementation. Proof demos the full flow at Money20/20, Las Vegas, October 18–21, booth 5069.
Sources
- Proof launches x401 — official press release, October 15, 2026
- x401 — Identity protocol for agentic commerce — official spec site (v0.1.0)
- Proof — official homepage