Updated 2026-10-20

AI agent identity: how agents prove who they act for, with x401 next to x402

AI agent identity means a website can check which real person an agent acts for and what that person approved. x401, an open protocol from Proof, asks for that proof with an HTTP 401 response, the way x402 asks for payment with HTTP 402. Proof put x401 into production on October 15, 2026.

Get the free newsletter

What is AI agent identity, and why does it matter now?

It is proof of who stands behind an agent's request, not just proof that the agent holds a login. Proof's October 15, 2026 release puts the gap plainly: an agent may hold a valid password, OAuth token, API key or payment card, and none of them shows that the person behind it authorized a particular action. Proof cites Amazon's September 21 block of Meta's Muse shopping agent, which Amazon said did not identify itself. Without a way to check, a business can only block agents or let them through blind, as Proof's October 19 release with Circle puts it. Identity is one half; the other is what an agent is allowed to do. See AI agent security.

Sources: Proof via GlobeNewswire: Proof launches x401 (production launch) (Oct 15, 2026; checked 2026-10-20) · Proof via GlobeNewswire: Proof and Circle Show How AI Agents Can Prove Who They Act For and Pay in USDC (Oct 19, 2026; checked 2026-10-20)

What is x401?

x401 is an open protocol, created by Proof, that lets a website ask an AI agent to prove who it acts for. It extends HTTP 401 Unauthorized: the site answers with a PROOF-REQUEST header naming the claims it needs, such as age, legal identity or membership, and which issuers it trusts. The agent gets a credential presented, retries with a PROOF-RESPONSE header, and can trade the result for a short-lived token. The spec site lists it as Standard Draft 0.2.0 under the Apache-2.0 license. Proof first published x401 on June 25, 2026 and put it into production on October 15.

Sources: x401.id: x401 HTTP Proof Requirement Protocol, Standard Draft 0.2.0 (spec site and contributor list) (Draft 0.2.0, live page; checked 2026-10-20) · Proof via PRWeb: Proof Launches x401, the Open Protocol for Verifying the Authority Behind AI Agents (first publication; includes Circle VP Product quote) (Jun 25, 2026; checked 2026-10-20) · Proof via GlobeNewswire: Proof launches x401 (production launch) (Oct 15, 2026; checked 2026-10-20)

How the x401 handshake works

Per x401.id, there are four steps. The site returns 401 with a signed proof requirement. A credential manager fulfills the request, either natively through the browser's credentials API or relayed by the agent. The agent retries with the result, and the site checks the nonce, its own binding, the credential and the issuer. Optionally the agent then trades the result for a short-lived bearer token, so later requests skip the proof step.

Sources: x401.id: x401 HTTP Proof Requirement Protocol, Standard Draft 0.2.0 (spec site and contributor list) (Draft 0.2.0, live page; checked 2026-10-20)

Who built it, and who governs it

x401.id lists Proof's authors working with contributors from Circle, Lightspark, MATTR, Okta, OpenAI and Visa. In June, Proof said it would submit x401 to the FIDO Alliance's agentic authentication workgroup. In its October 15 release, Proof said it intends to place the protocol under neutral, independent governance. As of October 20, 2026, Proof still publishes and runs the reference implementation.

How is x401 different from x402?

x402 answers how an agent pays; x401 answers who it acts for. x402 uses HTTP 402 Payment Required: a server names a price, the agent pays, usually in stablecoins, and retries. x401 uses HTTP 401 with a proof request. The x401 spec says the two can run in sequence, prove first and then pay, or in parallel, or either one alone, and that neither artifact is accepted as the other. Proof's October 15 release says x402 is now stewarded by the Linux Foundation. Proof also lets sites pay it per identity claim over x402, so the two protocols meet in one exchange.

x401 vs x402
Aspect	x401	x402
Question it answers	Who is the agent acting for, and what did they approve?	Can the agent pay for this request?
HTTP status	401 Unauthorized	402 Payment Required
Request header	PROOF-REQUEST	Payment-Required
What the agent returns	A verifiable credential result (PROOF-RESPONSE)	A payment payload, usually stablecoins
Stewardship	Proof today; Proof says it intends neutral governance	x402 Foundation at the Linux Foundation
Status on 2026-10-20	Draft 0.2.0; in production at Proof since Oct 15, 2026	Production; x402.org says millions of transactions

Sources: x401.id: x401 HTTP Proof Requirement Protocol, Standard Draft 0.2.0 (spec site and contributor list) (Draft 0.2.0, live page; checked 2026-10-20) · x402.org: x402, an open, neutral standard for internet-native payments (live page, updated Aug 25, 2026; checked 2026-10-20) · Proof via GlobeNewswire: Proof launches x401 (production launch) (Oct 15, 2026; checked 2026-10-20)

What did Circle's CEO mean by 'Know Your Agent'?

On October 19, 2026, Circle CEO Jeremy Allaire posted 'Know Your Agent coming online,' calling x401 agent identity proofs alongside x402 agent payments a strong step towards safer agentic economic activity. He was quoting Circle's own post about a demo with Proof. Keep the two apart: x401 is Proof's protocol, and 'Know Your Agent' is Allaire's name for the pairing, not a separate Circle spec; on circle.com, KYA shows up only in partner listings such as AsterPay's. Circle's part is real but specific: in June, Circle's VP of Product called Circle an early adopter and co-endorser of x401.

Sources: Jeremy Allaire (Circle CEO) on X: 'Know Your Agent coming online' (Oct 19, 2026; checked 2026-10-20) · Circle on X: Circle and Proof, x401 identity plus x402 USDC payments, Money20/20 booth 5069 (Oct 19, 2026; checked 2026-10-20) · Proof via PRWeb: Proof Launches x401, the Open Protocol for Verifying the Authority Behind AI Agents (first publication; includes Circle VP Product quote) (Jun 25, 2026; checked 2026-10-20) · Circle Alliance Directory: AsterPay partner listing (describes Know Your Agent (KYA) trust scoring) (live page; checked 2026-10-20)

What did the Proof and Circle demo show?

It shows one purchase that needs both identity and payment. In the demo announced October 19 for Money20/20 in Las Vegas, October 19 to 21, a merchant answers an agent with an x401 request for a specific fact and an x402 request for payment in USDC. Proof's wallet presents the person's verified credential and a signed approval for that purchase, disclosing only the facts asked for. The agent pays from a Circle Agent Wallet, and the merchant keeps signed evidence for disputes. Both companies call it a demo and a collaboration they are still exploring, not a shipped joint product.

Sources: Proof via GlobeNewswire: Proof and Circle Show How AI Agents Can Prove Who They Act For and Pay in USDC (Oct 19, 2026; checked 2026-10-20) · Circle on X: Circle and Proof, x401 identity plus x402 USDC payments, Money20/20 booth 5069 (Oct 19, 2026; checked 2026-10-20)

Who can use x401 today?

Developers can, through Proof. Its October 15 release lists three things live: Proof's agent identity wallet, the x401 protocol, and a production MCP server that works with Meta's Muse, ChatGPT, Grok, Claude and other MCP assistants. Sites can deploy a reference implementation on Cloudflare Workers, with guides for Node, Python and Go, and request basic claims such as verified age, country and email without a sales process. Proof says Superfluid ran the first live implementation in September. Proof calls itself the first to put this into production, so treat x401 as early.

Sources: Proof via GlobeNewswire: Proof launches x401 (production launch) (Oct 15, 2026; checked 2026-10-20) · Proof: x401 developer page (live page; checked 2026-10-20)

What should a small business or agent builder do now?

Mostly watch, and test only where identity is already required. If you sell to agents and take x402 payments, nothing changes: x401 is optional and runs alongside. If you sell something age-gated or regulated, Proof's reference implementation is the place to start a test. If you run agents, keep purchases, signatures and payments behind your own approval: xAI's Grok Bot docs say to start with read-only tasks and drafts and keep purchasing and sending behind approval. If you use Grok Bot, the DartzDabz Crew Builder template sets that up, and nothing spends without your OK.

We may be paid by X based on how many people use our Crew Builder template.

Sources: Proof via GlobeNewswire: Proof launches x401 (production launch) (Oct 15, 2026; checked 2026-10-20) · Grok Bot docs: Approvals, security and privacy (live docs; checked 2026-10-18) · DartzDabz: x402 pay-per-call APIs

What else do people ask?

What is x401?

x401 is an open protocol from Proof that lets a website ask an AI agent to prove who it acts for. It extends HTTP 401 with a PROOF-REQUEST header and a PROOF-RESPONSE reply carrying a verifiable credential. Proof first published it in June 2026 and put it into production on October 15, 2026.

What is the difference between x401 and x402?

x402 handles payment through HTTP 402 Payment Required. x401 handles identity through HTTP 401 with a proof request. They can run together, prove first and then pay, or separately, and neither replaces the other.

Is x401 made by Circle?

No. x401 is Proof's protocol. Circle contributed to it, its VP of Product called Circle an early adopter and co-endorser, and Circle and Proof showed a joint x401 plus x402 demo at Money20/20 in October 2026.

What is Know Your Agent?

It is the phrase Circle CEO Jeremy Allaire used on October 19, 2026 for x401 identity proofs working alongside x402 payments. In that post it names the pairing, not a Circle specification. Other firms, such as Circle partner AsterPay, also use the term KYA for their own agent checks.

Can my AI agent use x401 today?

Yes, through Proof. Its production MCP server works with assistants including ChatGPT, Grok and Claude, and a person enrolls for a Proof credential the first time a site asks. The protocol lets other issuers build compatible credentials; Proof says it was first in production.

Do sites have to pay to use x401?

The protocol is open, and Proof says sites can request basic claims such as age, country and email without a sales process. Proof also offers pay-per-claim verification over x402. For current prices, check Proof's own pages.

Does x401 replace logins or API keys?

No. Proof's point is that logins, OAuth tokens and API keys show access, not that a person approved a specific action. x401 adds proof of the person and their approval on top of whatever access the agent already has.

What should you read next on DartzDabz?

Sources

DartzDabz: x402 pay-per-call APIs
Grok Bot docs: Approvals, security and privacy (live docs; checked 2026-10-18)
Circle Alliance Directory: AsterPay partner listing (describes Know Your Agent (KYA) trust scoring) (live page; checked 2026-10-20)
Proof via GlobeNewswire: Proof launches x401 (production launch) (Oct 15, 2026; checked 2026-10-20)
Proof via GlobeNewswire: Proof and Circle Show How AI Agents Can Prove Who They Act For and Pay in USDC (Oct 19, 2026; checked 2026-10-20)
Proof: x401 developer page (live page; checked 2026-10-20)
Proof via PRWeb: Proof Launches x401, the Open Protocol for Verifying the Authority Behind AI Agents (first publication; includes Circle VP Product quote) (Jun 25, 2026; checked 2026-10-20)
x402.org: x402, an open, neutral standard for internet-native payments (live page, updated Aug 25, 2026; checked 2026-10-20)
Circle on X: Circle and Proof, x401 identity plus x402 USDC payments, Money20/20 booth 5069 (Oct 19, 2026; checked 2026-10-20)
Jeremy Allaire (Circle CEO) on X: 'Know Your Agent coming online' (Oct 19, 2026; checked 2026-10-20)
x401.id: x401 HTTP Proof Requirement Protocol, Standard Draft 0.2.0 (spec site and contributor list) (Draft 0.2.0, live page; checked 2026-10-20)

Every number on this page is the source's own figure as of the date shown, and business results are self-reported by the operators. Links were checked on 2026-10-20.