x401 is a protocol introduced by Proof in June 2026 that uses an HTTP 401-style challenge for AI agents to present verifiable credentials. It proves facts about the human or organisation behind an agent, such as identity, age, membership, or signing authority, before a service grants access.

Does x401 replace x402?

No. They solve different problems. x402 gates a resource behind payment, while x401 gates it behind verified identity or authority. A service can require either or both, for example verifying a business's authority with x401 and then charging per request with x402.

Do agents need x401 to pay with x402?

No. x402 payments work without identity verification, since a valid payment is the proof required. x401 is relevant when a service must know who authorised the agent, such as for regulated, age-restricted, or contractual actions, in addition to or instead of payment.

x401 vs x402: Identity vs Payment for AI Agents

x401 and x402 are complementary HTTP protocols for AI agents. x402 uses the 402 Payment Required status to gate a resource behind payment, usually in stablecoins. x401, introduced by Proof in June 2026, uses a 401-style challenge so an agent can present a verifiable credential proving identity, age, membership, or signing authority of the human behind it.

What x402 does

x402 lets a server reply with HTTP 402 and payment terms. The agent pays, typically in USDC, and retries with proof. It makes per-request payment native to HTTP, without accounts or API keys, and is governed through the x402 Foundation under the Linux Foundation.

What x401 does

x401 is a challenge-response protocol built around HTTP 401. When a resource requires proof of who stands behind a request, the server issues a challenge and the agent presents a cryptographically verifiable credential, such as verified identity, age, membership, or authority to sign. Proof describes it as verifying the human behind the AI.

Who created x401

Proof, a company known for online notarization and identity verification, introduced x401 on June 25, 2026, and published a specification. Proof's announcement lists contributors from organisations including Circle, OpenAI, Okta, and others. Reports differ on the full list of backers, so the specification site is the best reference.

Why identity matters for agents

Some actions need more than payment: signing a contract, accessing age-restricted content, opening a regulated account, or acting for a company. Payment alone does not prove the agent's principal is authorised. Verifiable credentials let a service check authority without collecting full personal data.

Using both together

A service could require x401 to establish that an agent acts for a verified business with purchasing authority, then x402 to collect payment per request. Separating identity and payment keeps each protocol focused and lets services require only what they need.

Privacy considerations

Verifiable credentials can support selective disclosure, proving a fact such as age or membership without revealing everything else. x402 payments are pseudonymous onchain. Combining them should respect data minimisation, requesting identity only where the use case needs it.

Maturity

x402 has broad industry backing and production deployments. x401 is newer, introduced in mid 2026, and its adoption is still developing. Builders should treat the x401 specification as evolving and check its current version before implementing.

Example scenarios

A legal document service might require x401 to confirm that an agent can sign for a company, then charge per document with x402. An age-restricted content service might require x401 proof of age without collecting a birthdate. A public data API might require only x402 payment, since anyone willing to pay is welcome.

Implementation notes

x402 has client and server libraries for common languages and frameworks, plus hosted facilitators. x401 relies on verifiable credentials issued by identity providers and wallets that can present them. Agents that support both need a credential wallet as well as a payment wallet, with policies governing when each may be used.

Related protocols

Other agent protocols also touch identity and authorisation. Google's Agent Payments Protocol uses signed mandates as verifiable credentials to prove user intent for purchases. x401 focuses on proving facts about the principal for access decisions, while AP2 focuses on authorising specific payments.

Choosing what to require

Start by asking what the service actually needs to know. If any paying caller is acceptable, require only payment. If the law or the action requires knowing who is behind the agent, add identity. Requiring identity unnecessarily adds friction and data handling obligations without improving outcomes.

Aspect	x401	x402
Gate	Identity or authority	Payment
HTTP basis	401-style challenge	402 Payment Required
Proof presented	Verifiable credential	Signed payment, usually stablecoins
Origin	Proof, June 2026	Coinbase, 2025; now x402 Foundation
Typical use	Age, membership, signing authority	Pay-per-call APIs and resources

Frequently asked questions

What is x401?: x401 is a protocol introduced by Proof in June 2026 that uses an HTTP 401-style challenge for AI agents to present verifiable credentials. It proves facts about the human or organisation behind an agent, such as identity, age, membership, or signing authority, before a service grants access.
Does x401 replace x402?: No. They solve different problems. x402 gates a resource behind payment, while x401 gates it behind verified identity or authority. A service can require either or both, for example verifying a business's authority with x401 and then charging per request with x402.
Do agents need x401 to pay with x402?: No. x402 payments work without identity verification, since a valid payment is the proof required. x401 is relevant when a service must know who authorised the agent, such as for regulated, age-restricted, or contractual actions, in addition to or instead of payment.