# What Is the x401 Protocol? Proof’s ID Check for AI Agents

URL: https://whatisagenticai.net/blog/what-is-x401-protocol/
Published: 2026-10-20
Publisher: Little Tough LLC, maker of AI Agent Assistant: Agentic AI (https://apps.apple.com/us/app/ai-agent-assistant-agentic-ai/id6761501260)

The x401 protocol is Proof’s open standard, launched October 15, 2026, that lets websites ask an AI agent to prove which verified person it acts for. x401 vs x402.

The x401 protocol is a new open standard that lets a website ask an AI agent one simple question: who sent you, and did they really say yes? It was launched by the identity company Proof on October 15, 2026, and the phrase "x401 protocol" is already showing up in Google and Bing search suggestions.

If you have seen x401 next to x402 and wondered whether it is a crypto coin, a typo, or something you need to care about, here is the plain-English answer: what x401 is, how it works step by step, how it differs from x402, and what it means for anyone who lets an AI agent shop or sign things for them.

**TL;DR:** x401 is an open web protocol from Proof, launched October 15, 2026. When an AI agent tries to do something sensitive, like buy a product or move money, a website can answer with an x401 request that asks for proof of the real person behind the agent. That person approves on their own phone with Face ID or a fingerprint, and the site gets a signed record of exactly what they approved. It checks the human, not the AI. x402 is a separate protocol for payments, and the two are built to work together.

## What is the x401 protocol?

x401 (also written X401, or "x 401") is an "open HTTP protocol" that extends HTTP 401, the web’s standard "Unauthorized" response. Today a 401 basically means "log in first." With x401, a website can say something more specific: "Before I go on, show me evidence of the person you work for, at this level of trust, and have them sign these exact terms."

Proof calls the problem it is solving the "Agent Evidentiary Gap." An agent can hold a valid password, an API key, or even a saved card. None of those prove that a real person approved this particular purchase or transfer. x401 is meant to close that gap.

Proof runs a certificate authority audited under WebTrust. It published the spec at proof.com/x401 and the developer docs at x401.id, where it is listed as version 0.1.0 and still in active development.

## How does x401 work?

Picture an agent trying to book a $900 flight for you. Here is the flow Proof describes, simplified:

- **The site pushes back.** Instead of just saying no, the website replies with HTTP 401 plus a PROOF-REQUIRED header. It lists what it needs: for example, a verified legal name, proof you are over 18, or a signature on the price and recipient.

- **The agent asks you.** Your agent forwards the request to you. You unlock with a biometric on your own device.

- **Your wallet shows the details.** Proof’s new agent identity wallet shows what is being asked for and the exact terms. If you approve, a hardware-protected key signs the answer.

- **The site checks it.** The agent sends the signed answer back in a PROOF-PRESENTATION header. The site checks who issued the credential, the signature and the terms, then lets the request through. It can keep the signed record in case of a dispute.

Two details make this useful. First, if anything in the signed terms changes, such as the amount or the recipient, the signature stops being valid. Second, it supports selective disclosure, so an agent can prove you are over 18 without sharing your birthday.

Behind the scenes, each verified person holds an X.509 certificate issued by Proof after identity checks that Proof says meet NIST Identity Assurance Level 2, the US government’s middle tier for remote ID proofing. The developer spec builds on existing standards such as OpenID4VP and W3C Verifiable Credentials.

## x401 vs x402: what is the difference?

This is the most common question, because the names are one digit apart. They solve different halves of the same problem.

|  | x401 | x402 |
| --- | --- | --- |
| Question it answers | Who is behind this agent, and what did they approve? | How does this agent pay? |
| Built on | HTTP 401 "Unauthorized" | HTTP 402 "Payment Required" |
| Who is behind it | Proof, which says it plans to hand it to neutral governance | Stewarded by the Linux Foundation, with 40+ member groups as of July 2026 (per Proof) |
| Launched | October 15, 2026 | Earlier, and already in use for agent payments |
| Is it a coin? | No | No, it is a payment protocol, not a token |

Proof says the two are designed to run side by side: a site can ask for identity with x401 and take payment with x402. Proof even charges websites per identity claim over x402, with no contract or minimum.

## Why x401 is launching now

AI agents are starting to act on people’s accounts, and websites have no good way to tell a helpful agent from a bad bot. Proof’s launch post points to a recent example: it says Amazon blocked Meta’s Muse agent from its marketplace on September 21, two weeks after Muse launched, saying the agent did not identify itself. Proof also cites Cloudflare data from June showing bots made up 57% of page requests on its network.

Proof CEO Pat Kinsel summed up the pitch this way: "Blocking agents is understandable, but it’s not sustainable." The idea is that sites can let agents in if they can see a verified human and a signed approval behind each sensitive action.

## Who supports x401 so far?

- **AI assistants:** Proof launched a production MCP server (the plug-in standard many agents use to reach tools) and says it works with Meta’s Muse, ChatGPT, Grok and Claude. That means those assistants can connect to it, not that their makers have endorsed x401.

- **First live use:** Superfluid, which builds continuous-settlement infrastructure for tokenized markets, shipped the first live x401 implementation in its Superfluid Wallet in September.

- **Developers:** A reference implementation for Cloudflare Workers, plus guides for Node, Python and Go. Basic claims like verified age, country and email can be requested without a sales call.

- **Unnamed adopters:** Proof’s x401 page says a global payments network is adopting it and a large insurer is evaluating it, but names neither. Treat that as unconfirmed.

Some secondary sites claim OpenAI, Google, Circle or Okta "back" x401. We could not find that in Proof’s own announcements, so we are not repeating it as fact.

## What this means for you

You do not need to install anything today. x401 is plumbing for websites and agent builders. But it points to where agents are heading: the more an agent can do, the more often the web will stop and ask, "Did a real person approve this?" That is a good thing. It keeps you in the loop for the actions that matter, like spending money or signing your name.

It is the same idea we explain in [how AI agents work](https://whatisagenticai.net/blog/how-ai-agents-work/): autonomy is a dial, and for most people the right setting is "the agent does the legwork, you make the call." It also matters for always-on agents like [OpenAI Dots](https://whatisagenticai.net/blog/what-are-openai-dots/), which act for you around the clock.

That is how our app is built. **Agentic AI** gives you a team of up to four expert agents on your iPhone and iPad for research, writing, planning and more. They hand you finished work to review, and you decide what happens next. There is no account to create, and your first 3 tasks are free.

## Quick answers

**What is the x401 protocol?** An open web protocol from Proof, launched October 15, 2026, that lets a website require an AI agent to show verified proof of the person it acts for, plus that person’s signed approval of the exact transaction.

**Who made x401?** Proof, an identity company led by CEO Pat Kinsel. It publishes the spec at proof.com/x401 and x401.id and says it intends to move the protocol to neutral, independent governance.

**What is the difference between x401 and x402?** x401 handles identity and approval (who is behind the agent). x402 handles payment. They are separate protocols designed to work together.

**Is x401 a crypto coin?** No. It is a web protocol, not a token. Any coin using the name is unrelated to Proof’s standard.

**Is x401 on GitHub?** Proof offers a reference implementation for Cloudflare Workers and guides for Node, Python and Go through its developer site, x401.id. Check there for the current code links, since the spec is at version 0.1.0 and still changing.

**Does x401 verify the AI?** No. It verifies the human behind the AI and what they authorized. Learn more terms in our [agentic AI glossary](https://whatisagenticai.net/agentic-ai-glossary/).

**Sources:** [Proof: launch announcement](https://www.proof.com/blog/proof-launches-x401-giving-ai-agents-a-way-to-prove-who-they-represent---and-what-theyre-authorized-to-do) · [Proof: x401 overview](https://www.proof.com/x401) · [GlobeNewswire](https://www.globenewswire.com/news-release/2026/10/15/3381718/0/en/proof-launches-x401-giving-ai-agents-a-way-to-prove-who-they-re-authorized-to-do.html) · [ID Tech](https://idtechwire.com/proof-launches-x401-protocol-to-tie-ai-agent-requests-to-verified-people/) · [Yahoo Finance](https://finance.yahoo.com/technology/ai/articles/proof-launches-x401-giving-ai-130000469.html)