Since 1997, HTTP has carried two status codes that sat side by side doing almost nothing: 401 Unauthorized — "tell me who you are" — and 402 Payment Required — "pay me."
We've spent the past year building a business on the second one: 19 services, 500+ endpoints, answering hundreds of thousands of 402 challenges a month from AI agents paying in USDC micropayments.
This summer, the first one finally got its job.
x401, in plain language
Proof's x401 protocol — launched June 25 with backing from Circle, OpenAI, Google, and Okta — gives every website and API a standard way to ask the question the agent economy has been dodging: which human is actually behind this agent?
Today, when an agent hits a paid endpoint, the seller knows exactly one thing: whether its money is good. That's what x402 proves, and for a $0.001 weather lookup it's plenty. But the moment an agent wants to do something that matters — sign a contract, access age-restricted data, spend real money on someone's behalf — "the money is good" stops being enough.
x401 lets the service respond like a bouncer: prove it. The agent answers with a cryptographically signed Verifiable Credential (the same W3C standard behind digital driver's licenses) attesting to exactly the claim requested: verified identity, age, org affiliation, signing authority, or simply "a real human authorized this."
The clever part is what it doesn't reveal. Selective disclosure and zero-knowledge proofs mean an agent can prove "my principal is over 18" without handing over a name, birthdate, or passport scan.
Circle's VP of Product compressed the whole thing into one sentence:
"x402 answers how an agent pays, x401 answers who it is."
Why sellers should care
1. It unlocks the expensive endpoints. Nobody needs identity for a $0.005 timezone lookup. But the endpoints the agent economy keeps NOT building — legal research, medical data, financial actions, anything regulated — are stuck precisely because sellers can't know who's buying. A standard "verified human / verified org / verified authority" gate is the unlock for everything above the micropayment tier.
2. It's an anti-fraud layer we personally needed last week. Days ago we documented an address-poisoning attack on our own fleet — possible because on-chain, a wallet is just 40 anonymous characters. An identity layer that binds "this wallet acts for this verified principal" makes impersonation-by-lookalike dramatically harder. Payments without identity is exactly the gap that attack lives in.
3. The backers are the tell. Circle settles nearly all x402 volume; OpenAI and Google own the agents; Okta owns enterprise identity. Proof says it will submit x401 to the FIDO Alliance's agentic-authentication workgroup — the same body that took over Google's AP2. The standards are consolidating fast.
The honest caveats
x401 launched with a spec, docs, sample apps, and exactly one live implementation — Proof's own digital ID. That's a real start, not an ecosystem. "Issuer-neutral" is the promise, but today the flagship issuer is the company that wrote the protocol, and any identity network is worth exactly as much as its slowest-moving verifier.
We've watched this movie before: x402 taught us that a protocol can be institutionally blessed and still have a quarter of its sellers unable to take a payment. Standards announcements are the easy part. Interop is where economies are actually built — or quietly lost.
Our plan: prototype an x401 challenge on one of our own gated endpoints the same way we dogfood everything else — pay it, probe it, break it, and publish what we find. If the agent web is getting a second handshake, we want field notes from the first grip.
We publish everything we learn operating 500+ paid x402 endpoints. More field notes at forgemesh.io/blog, and a free scan that checks whether stock agent clients can actually pay your endpoint today — on the rail that already works.
Top comments (0)