What Is x401? Identity Proof for Agentic Commerce
All topicsDraft HTTP identity-proof requirements for agentic commerce: credential verification, issuer trust and the boundary with x402 payments.
Reviewed protocol reference
x401 is a draft HTTP protocol for requesting credential-based proof before granting access to a protected resource. Its version 0.1.0 specification separates proof handling from payment: the service sets evidence requirements, an agent obtains a wallet presentation, and the verifier evaluates the proof. The verifier decides which issuers it trusts. Proof's October 15, 2026 announcement describes production wallet and agent capabilities; it does not turn the draft into a mandatory payment-network standard.
Draft protocol · reviewed 2026-10-16
Protocol timeline
Proof announces production agent identity-wallet capabilities. The company says initial protocol publication was in June 2026; an exact June date has not been independently verified. Source
Editorial review confirms version 0.1.0 is marked Draft. This is a review date, not a protocol release date. Source
Frequently asked questions
- What is x401?
- A draft HTTP protocol for requesting credential-based proof before access to a protected resource or action is granted. The reviewed specification is version 0.1.0.
- How is x401 different from x402?
- x401 handles proof requirements. Payment, when required, uses HTTP 402 and a separate payment protocol such as x402. x401 does not itself move or settle money.
- Was x401 first published in October 2026?
- No. Proof says it first published x401 in June 2026. Its October 15 announcement describes production capabilities; the specification remains a draft.
- What should implementers check?
- Check accepted issuers and credentials, challenge binding and replay protection, the scope of authorized actions, and disclosure and retention policies. A successful proof exchange does not by itself establish regulatory compliance or replace payment authorization.
- How should compatibility claims be assessed?
- Verify the specific implementation and version with both providers. Protocol documentation alone does not establish compatibility, certification or a partnership.
Further reading
Regulatory references are background reading, not evidence of a provider’s licences. No integration, compatibility or certification is implied.