Businesses accepting instructions from AI agents often cannot confirm who the agent is acting for, or whether that person approved a specific action. Proof has launched x401, an open HTTP protocol, together with an agent identity wallet and a Model Context Protocol (MCP) server, to address this. The tools work with AI assistants including Meta's Muse, ChatGPT, Grok, and Claude.
How x401 links identity to transaction approval
x401 extends the HTTP 401 response, allowing a website to set out the evidence an agent must provide before proceeding. Websites can request verified identity claims, such as legal name, age, or nationality, and ask the consumer to cryptographically sign the terms of a transaction. The consumer reviews the request in Proof's wallet and approves it with a biometric on their own device, where a hardware-protected key signs it. If the agent changes the amount, recipient, or other signed terms, the signature no longer validates.
Proof supports signing for wire instructions, payment mandates, itemised purchases, and developer-defined data. Each verified person holds an X.509 certificate issued after NIST IAL2 identity proofing. x401 also works alongside x402, the HTTP-native payment protocol stewarded by the Linux Foundation, allowing websites to pay Proof per identity claim without a contract or minimum commitment. Superfluid has implemented x401 in its wallet, and ZhiCheng Miao, Founder and CEO of Superfluid, said it lets services verify who an agent represents.
Regulatory and market context for agent identity
The launch follows Amazon's decision in September 2026 to block Meta's Muse agent, citing concerns that it did not identify itself and moved through accounts without Amazon's consent. On 8 September 2026, FinCEN and federal banking regulators also issued guidance recognising digital certificates and verifiable credentials, including those from non-government issuers, as permissible ways to verify customer identity, provided the issuer applies the same level of authentication as the bank. Consumer trust remains limited: an Exploding Topics survey of more than 1,000 US consumers found that 31% would not let an AI agent spend any money on its own.
Pat Kinsel, Founder and CEO of Proof, said businesses are being asked to accept instructions from software acting for customers without a reliable way to prove who those customers are or what they approved. Proof first published x401 in June 2026 with technical contributors including Visa, Circle, and Okta, and plans to place the protocol under neutral, independent governance. The specifications are available for independent implementations, audits, and competing credential issuers.
