New open protocol aims to show who is behind an AI agent

When an AI agent logs in, buys something or signs something on the web, it is hard for a website to know who is really behind it. The company Proof wants to change that. On June 25, 2026, it launched x401, an open protocol that lets a website or API require the agent to prove who it is acting on behalf of and what the person has approved.

An AI agent is a program that carries out tasks on its own for a user. An API is an entry point that programs use to talk to each other.

How it is meant to work

x401 extends the web's core language, HTTP, with a standardized identity challenge and response. The server makes the demand, and the client fulfills it cryptographically. According to Proof's blog, it works much like the x402 payment protocol.

A service can, for example, ask for proof of verified identity, age, membership, affiliation with an organization, signing authority or that a human is behind the request. The service checks the issuer, claim, scope and action before it proceeds. The protocol is issuer-neutral: Any issuer that complies with the standard can issue credentials, and the service decides for itself which requirements and issuers it accepts.

According to Proof, agents do not get an independent legal identity. They inherit the identity of the person or organization that has authorized them. The user signs off on exactly which actions the agent may perform, and Proof says no API keys or sensitive personal data are shared. Proof also says the design is meant to meet U.S. requirements in the ESIGN Act and UETA that an action be attributable to the person who is to be bound.

Proof's own solution

Proof has an agent identity wallet, where a person's verified legal identity is stored and where the person approves what the agent may do. Proof calls it the first live x401-compatible implementation. According to Proof, the solution works with Claude and ChatGPT through an MCP server.

Pat Kinsel, CEO of Proof, says: "AI makes it easy to generate actions and content. Trust comes from knowing who is behind them."

Who is on board, and what comes next?

Among the named contributors to the protocol are people from Circle, OpenAI, Okta, MATTR and Lightspark. Cloudflare and Superfluid Finance are mentioned as subsequent partners. The specification, documentation and sample apps are publicly available at x401.id and dev.proof.com. Proof plans to submit the standard to the FIDO Alliance.

It is worth knowing that nearly everything comes from Proof itself. That includes the company's figures of $640 billion in secured transactions for 10,000 organizations and the claim that agent traffic has overtaken human traffic on the web. This has not been verified, and the sources do not show how many websites and issuers are actually adopting the protocol.