What Is x401? Proof's Agent Identity Protocol, Checked Against a Live x402 Endpoint
x401 is Proof's open, HTTP-based proof-requirement protocol: a server answers with a 401 plus a PROOF-REQUEST header naming the credential an agent must present — personhood, residency, accreditation, membership, or a signed authorization — and the agent retries with PROOF-RESPONSE. It is deliberately separate from payment: x401 proves who stands behind an agent and what that person approved; HTTP 402 plus x402 still handles the money.
On October 15, 2026, Proof put the identity side into production: an agent identity wallet (verified legal identity; the person approves on their own device with a biometric; changing a signed amount or recipient invalidates the signature), the x401 protocol, and a production MCP server. Websites can also pay Proof per identity claim over x402.
The quotable measurement: ScriptMasterLabs' October 16, 2026 probe of its own live Verdict Protocol endpoint found the payment and decision layers live — HTTP 402 quoting $0.25 USDC on Base, status LIVE_SETTLEMENT_VERIFIED — and the identity layer absent: no PROOF-REQUEST, PROOF-RESPONSE, or PROOF-RESULT header on the response.
Today's live probe (October 16, 2026, ~09:20 EDT)
-
GET https://verdict.scriptmasterlabs.com/health→ 200 (4.09s, single measurement) -
GET /.well-known/agent.json→LIVE_SETTLEMENT_VERIFIED; /decide $0.25 USDC BYOK, /seal $0.01, Base (eip155:8453) -
POST /decidewith no payment → HTTP 402; response headers exposePAYMENT-REQUIRED, PAYMENT-RESPONSE— and noPROOF-*header of any kind - Directory context the same morning: x402 List counts 1,021 services listed, 959 payment-ready, only 13 delivery-verified; the CDP Bazaar discovery total read 43,089 (limit=100) vs 37,267 on Oct 14 by the same method — two readings, not a growth claim
The layer x401 does not cover
A signed mandate proves a person approved those terms. It does not score whether the instruction inside the mandate is wise — a person can sign a bad purchase. The stack needs all three, in order: x401 evidence first (who/what approved), a decision gate second (≥0.80 auto-pay, 0.50–0.79 confirm, <0.50 escalate), x402 settlement last.
Honest caveats
- x401 is a draft (0.2.0), not a finished standard; 0.2.0 broke with 0.1.0, so explainers using the old header names are stale.
- SML has not implemented x401 — this is a gap measurement of our own endpoint, not a product claim.
- Proof's "first into production" framing is Proof's own statement in its launch release.
Full canonical with the dated receipts table, Claim Receipts and the DIY header audit: https://scriptmasterlabs.com/what-is-x401
Top comments (1)
Splitting identity from payment is the right cut, because the failure modes never overlap: an identity check fails closed on who you are, while a payment can fail open on retries and reconciliation, and bundling them makes one timeout take out both. The honest caveats are what make this useful, especially the note that 0.2.0 broke the header names from 0.1.0, since that is exactly the kind of thing that turns into a month of debugging against stale tutorials. One question on the live probe: the 4.09s single measurement on /health reads slow for an identity path, fine for a check but worth watching if PROOF-REQUEST ever rides inline on a paid request.