# x401: HTTP Proof Requirement Protocol

[2 · Identify](/category/identify/)

| x401: HTTP Proof Requirement Protocol |
| --- |
| Category | [Identify](/category/identify/) |
| Governed by | Editors Daniel Buchner (Proof) and Bhushit Agarwal (Circle); Apache-2.0 repository proof/x401; Proof says it plans to submit x401 to the FIDO Alliance agentic authentication workgroup |
| Status | Status: Draft, Version 0.2.0 (version 0.1.0 still published at /spec/0.1.0/); the spec page carries no date |
| Phase | draft |
| Implementation | shipping |
| Adoption | claimed — Proof (Superfluid named as a live implementation, 2026-09-22) |
| Version | 0.2.0 (Draft) |
| Specification | [https://x401.proof.com/spec/latest/](https://x401.proof.com/spec/latest/) |
| Found at | none — signalled per request on the protected resource, not at a fixed path |
| Last checked | 2026-10-20 |
| Freshness | current · checked 2026-10-20 |
| Solves | Prove an agent's identity, Delegate a user's authority to an agent |

x401: HTTP Proof Requirement Protocol is an agentic-web standard (HTTP header) at step 2, Identify, governed by Editors Daniel Buchner (Proof) and Bhushit Agarwal (Circle); its own status is "Status: Draft, Version 0.2.0 (version 0.1.0 still published at /spec/0.1.0/); the spec page carries no date" (draft). It answers: How can a resource ask an agent to prove something about the person behind it, such as being a verified human, before serving a request? Adoption is claimed by Proof (Superfluid named as a live implementation, 2026-09-22), last verified 2026-10-20.

[Identify](/category/identify/) x401 is an HTTP challenge-response pattern for proof of identity. A resource sends a PROOF-REQUEST header naming the verifiable credential it needs, and the agent answers with a PROOF-RESPONSE; the verifier sends back its own information, including any proof error, in a PROOF-RESULT header [[1]](#ref-1). All three headers carry base64url JSON. The credential request uses OpenID4VP over the browser Digital Credentials API, with DCQL queries. An optional OAuth token exchange turns a successful proof into a reusable Verification Token [[1]](#ref-1).

## Overview
The name echoes x402, and the two are meant to sit side by side. x401 does not use the HTTP status code to carry proof state, and payment stays in a separate 402 flow [[1]](#ref-1).

The spec is a Draft at version 0.2.0, edited by Proof and Circle, with the code under Apache-2.0 [[1]](#ref-1)[[2]](#ref-2). Proof launched it on 2026-06-25 and says it plans to take it to the FIDO Alliance's agentic authentication workgroup [[3]](#ref-3). Proof names Superfluid as a live implementation [[4]](#ref-4)[[5]](#ref-5); that claim comes from Proof, not from a count.

## Discovery and probe

PROOF-REQUEST response header on a protected resource · none — signalled per request on the protected resource, not at a fixed path

```
GET {origin}/{protected-path}
parse:     A PROOF-REQUEST response header carrying base64url JSON that describes the credential required (OpenID4VP/DCQL)
on absent: No PROOF-REQUEST header means this path does not ask for proof via x401; other paths on the same origin may.
```

Not probed live: no-fixed-path. A PROOF-REQUEST header appears only on a resource that asks for proof; there is no fixed path to check.

## History
- 2026-10-20 — added from gap scout 2026-10-20; verified against x401.proof.com/spec/latest/, github.com/proof/x401 and Proof's launch and Superfluid posts

## Instances

No instances recorded yet.

## See also

## References

- The x401 spec page reads 'Status: Draft' and 'Version: 0.2.0', names editors Daniel Buchner (Proof) and Bhushit Agarwal (Circle), and defines PROOF-REQUEST, PROOF-RESPONSE and PROOF-RESULT headers carrying base64url JSON; credential requests use OpenID4VP over the Digital Credentials API with DCQL, an optional OAuth token exchange yields a reusable Verification Token, and payment stays in a separate 402 flow. — [https://x401.proof.com/spec/latest/](https://x401.proof.com/spec/latest/) VERIFIED
- The proof/x401 repository is Apache-2.0 licensed, created 2026-05-07 and last pushed 2026-10-18, with no tags. — [https://github.com/proof/x401](https://github.com/proof/x401) (2026-10-18) VERIFIED
- Proof's launch post announces x401 with Circle as named co-endorser and says Proof plans to submit it to the FIDO Alliance agentic authentication workgroup. — [https://www.proof.com/blog/identity-infrastructure-agentic-internet-x401](https://www.proof.com/blog/identity-infrastructure-agentic-internet-x401) (2026-06-25) VERIFIED
- Proof's post 'Proof and Superfluid: A Verified Human Behind Every Agent Transaction' describes Superfluid's live use of x401. — [https://www.proof.com/blog/proof-and-superfluid-a-verified-human-behind-every-agent-transaction](https://www.proof.com/blog/proof-and-superfluid-a-verified-human-behind-every-agent-transaction) (2026-09-22) VERIFIED
- Biometric Update reports Proof and Superfluid testing reusable identity for an AI agent wallet. — [https://www.biometricupdate.com/202609/proof-superfluid-test-reusable-identity-for-ai-agent-wallet](https://www.biometricupdate.com/202609/proof-superfluid-test-reusable-identity-for-ai-agent-wallet) (2026-09-24) REPORTED

[JSON](/data/protocols/x401.json) · [Markdown](/protocols/x401/index.md)