agenticweb.wiki

x401: HTTP Proof Requirement Protocol

x401: HTTP Proof Requirement Protocol is an agentic-web standard (HTTP header) at step 2, Identify, governed by Editors Daniel Buchner (Proof) and Bhushit Agarwal (Circle); its own status is "Status: Draft, Version 0.2.0 (version 0.1.0 still published at /spec/0.1.0/); the spec page carries no date" (draft). It answers: How can a resource ask an agent to prove something about the person behind it, such as being a verified human, before serving a request? Adoption is claimed by Proof (Superfluid named as a live implementation, 2026-09-22), last verified 2026-10-20.

Identify x401 is an HTTP challenge-response pattern for proof of identity. A resource sends a PROOF-REQUEST header naming the verifiable credential it needs, and the agent answers with a PROOF-RESPONSE; the verifier sends back its own information, including any proof error, in a PROOF-RESULT header [1]. All three headers carry base64url JSON. The credential request uses OpenID4VP over the browser Digital Credentials API, with DCQL queries. An optional OAuth token exchange turns a successful proof into a reusable Verification Token [1].

Overview

The name echoes x402, and the two are meant to sit side by side. x401 does not use the HTTP status code to carry proof state, and payment stays in a separate 402 flow [1].

The spec is a Draft at version 0.2.0, edited by Proof and Circle, with the code under Apache-2.0 [1][2]. Proof launched it on 2026-06-25 and says it plans to take it to the FIDO Alliance's agentic authentication workgroup [3]. Proof names Superfluid as a live implementation [4][5]; that claim comes from Proof, not from a count.

Discovery and probe

PROOF-REQUEST response header on a protected resource · none — signalled per request on the protected resource, not at a fixed path

GET {origin}/{protected-path}
parse:     A PROOF-REQUEST response header carrying base64url JSON that describes the credential required (OpenID4VP/DCQL)
on absent: No PROOF-REQUEST header means this path does not ask for proof via x401; other paths on the same origin may.

Not probed live: no-fixed-path. A PROOF-REQUEST header appears only on a resource that asks for proof; there is no fixed path to check.

History

Instances

No instances recorded yet.

See also

References

  1. The x401 spec page reads 'Status: Draft' and 'Version: 0.2.0', names editors Daniel Buchner (Proof) and Bhushit Agarwal (Circle), and defines PROOF-REQUEST, PROOF-RESPONSE and PROOF-RESULT headers carrying base64url JSON; credential requests use OpenID4VP over the Digital Credentials API with DCQL, an optional OAuth token exchange yields a reusable Verification Token, and payment stays in a separate 402 flow. — https://x401.proof.com/spec/latest/ VERIFIED
  2. The proof/x401 repository is Apache-2.0 licensed, created 2026-05-07 and last pushed 2026-10-18, with no tags. — https://github.com/proof/x401 (2026-10-18) VERIFIED
  3. Proof's launch post announces x401 with Circle as named co-endorser and says Proof plans to submit it to the FIDO Alliance agentic authentication workgroup. — https://www.proof.com/blog/identity-infrastructure-agentic-internet-x401 (2026-06-25) VERIFIED
  4. Proof's post 'Proof and Superfluid: A Verified Human Behind Every Agent Transaction' describes Superfluid's live use of x401. — https://www.proof.com/blog/proof-and-superfluid-a-verified-human-behind-every-agent-transaction (2026-09-22) VERIFIED
  5. Biometric Update reports Proof and Superfluid testing reusable identity for an AI agent wallet. — https://www.biometricupdate.com/202609/proof-superfluid-test-reusable-identity-for-ai-agent-wallet (2026-09-24) REPORTED

JSON · Markdown