x401 is Proof's open, HTTP-based proof requirement protocol. A server responds 401 with a PROOF-REQUEST header naming the credential an agent must present — personhood, residency, accreditation, membership, or a signed authorization — and the agent retries with PROOF-RESPONSE; the verifier reports results in PROOF-RESULT. It is deliberately separate from payment: x401 proves who stands behind an agent and what that person approved, while HTTP 402 plus x402 handles payment. The specification is Draft 0.2.0.

How does x401 work with x402?

They cover different layers of one exchange. x401 establishes who is behind a request and carries signed evidence of what that person approved; a decision gate scores whether the action should fire; x402 then settles the payment. Proof designed x401 to work alongside x402 and lets websites pay Proof per identity claim over x402. On October 16, 2026, ScriptMasterLabs probed its own live x402 decision endpoint and found the payment layer live (402 quoting $0.25 USDC on Base) with no PROOF-* headers at all — the identity layer is not yet present on a typical production 402 endpoint.

Is x401 a finished standard?

No. The specification is Draft 0.2.0, a breaking redesign of 0.1.0 — explainers using the old PROOF-REQUIRED header name are stale. Proof first published x401 in June 2026, put its agent identity wallet, the protocol, and a production MCP server into production on October 15, 2026, and says it intends the protocol to move to neutral, independent governance, which has not happened yet.

What is x401?

Q: Does an x401 signed mandate mean an agent's purchase is safe?

No. A mandate proves a verified person approved those exact terms — changing a signed amount or recipient invalidates the signature — but it does not score whether the instruction inside the mandate is wise. A person can sign a bad purchase. That is why the stack needs a judgment layer between proof and payment: a decision gate that auto-pays at confidence 0.80 or above, holds for confirmation at 0.50-0.79, and escalates below 0.50.

ScriptMasterLabs — October 16, 2026. Sources: Proof's October 15, 2026 production launch release, the x401 specification (Draft 0.2.0) and its GitHub repository, and this morning's direct probes of a live production x402 endpoint.

x401 is Proof's open, HTTP-based proof-requirement protocol: a server answers a request with a 401 plus a PROOF-REQUEST header naming the credential an agent must present — personhood, residency, accreditation, membership, or a signed authorization — and the agent retries with PROOF-RESPONSE. It is deliberately separate from payment: x401 proves who stands behind an agent and what that person approved; HTTP 402 plus x402 still handles the money.

On October 15, 2026, Proof put the identity side into production — an agent identity wallet, the x401 protocol, and a production MCP server. On October 16, we probed our own live x402 decision endpoint for an x401 surface and found none: POST https://verdict.scriptmasterlabs.com/decide exposed PAYMENT-REQUIRED / PAYMENT-RESPONSE and zero PROOF-* headers.

The quotable measurement: ScriptMasterLabs' October 16, 2026 probe of its own live Verdict Protocol endpoint found the payment and decision layers live — HTTP 402 quoting $0.25 USDC on Base, status LIVE_SETTLEMENT_VERIFIED — and the identity layer absent: no PROOF-REQUEST, PROOF-RESPONSE, or PROOF-RESULT header on the response. That is the state of the agentic stack in one endpoint: agents can pay and be scored; they cannot yet prove who authorized them, in-protocol.

Dated receipts

Date	Fact	Source
June 2026	Proof first publishes x401, with technical contributors from payments, identity and AI organizations (Visa, Circle, Okta named by Proof)	Proof launch release, Oct 15, 2026
Current	Spec status: Draft 0.2.0. Three headers — `PROOF-REQUEST`, `PROOF-RESPONSE`, `PROOF-RESULT` — carrying a verifier-authored Digital Credentials API / OpenID4VP request. The spec explicitly does not define payment	x401.proof.com spec index; proof/x401 GitHub README (Apache 2.0), read Oct 16, 2026
Sept 8, 2026	FinCEN, with Federal Reserve, FDIC, NCUA and OCC staff, updates CIP guidance recognizing digital certificates and verifiable credentials as permissible customer-identity verification, under conditions	Proof release summarizing the guidance
Sept 21, 2026	Amazon blocks Meta's Muse from its marketplace, citing (per Proof's account) an agent that did not identify itself	Proof launch release — Proof's framing, labeled as such
Sept 2026	Superfluid Wallet ships what Proof calls the first live x401 implementation	Proof launch release — vendor-reported early adopter
Oct 15, 2026	Production launch: agent identity wallet (verified legal identity; the person approves on their own device with a biometric; changing a signed amount or recipient invalidates the signature), the x401 protocol, and a production MCP server working with MCP-compatible assistants. Websites can also pay Proof per identity claim over x402	Proof launch release (GlobeNewswire), Oct 15, 2026
Oct 16, 2026	Directory context: x402 List counts 1,021 x402 services listed (926 answering, 95 offline), 959 payment-ready, only 13 delivery-verified. Separately, the CDP Bazaar discovery endpoint's pagination total read 43,089 today (GET, limit=100) vs 37,267 by the same endpoint and method on Oct 14 — two readings, not a growth claim: index counting can change	x402-list.com/state-of-x402 + CDP discovery probe, Oct 16, 2026
Oct 16, 2026, ~09:20 EDT	SML live probe (next section)	This run's direct curl probes

Today's live probe of a production x402 endpoint (October 16, 2026, ~09:20 EDT)

GET https://verdict.scriptmasterlabs.com/health → 200, {"status":"ok","integrationsConfigured":true} (4.09s, single measurement)
GET https://verdict.scriptmasterlabs.com/.well-known/agent.json → status LIVE_SETTLEMENT_VERIFIED; POST /decide $0.25 USDC BYOK, POST /seal $0.01, Base (eip155:8453), USDC 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913, payTo 0x5bbd32e0478e49a7540ef2d760e0b0f9aa6328b2
POST /decide with no payment → HTTP 402. Response headers expose PAYMENT-REQUIRED, PAYMENT-RESPONSE — and no PROOF-* header of any kind
Every internal page linked from this piece returned 200 before linking (checked this run)

Finding, honestly stated: the endpoint that can charge an agent and score its decision cannot ask that agent for credential proof in-protocol. Identity today travels out-of-band (accounts, API keys, allowlists) or not at all — exactly the gap x401 is drafted to close, and exactly why a draft header spec matters to anyone already running 402 endpoints.

The three layers — and the one x401 does not cover

Layer	Question	Protocol / mechanism
Identity + authorization	Who is behind this agent, and what did that person approve?	x401 (`PROOF-REQUEST` challenge; signed, tamper-evident mandate)
Judgment	Should this specific action fire at all?	A decision gate: ≥0.80 auto-pay, 0.50–0.79 confirm, <0.50 escalate — the pattern on decision-gated payments, production form at Verdict Protocol
Payment	How does the money move?	HTTP 402 + x402 (here: $0.25 USDC on Base, settled via facilitator)

A signed mandate proves a person approved those terms. It does not score whether the instruction inside the mandate is wise — a person can sign a bad purchase, which is the failure mode behind the agentic-commerce liability gap and this month's intent frameworks (Amex Intent Intelligence). Proof of approval is evidence; the gate is judgment. You need both, in that order: x401 evidence first, gate score second, x402 settlement last. The identity-vs-judgment split is the same one we measured for enterprise identity in RSA Agent ID — x401 is its protocol-level form.

What the top answers miss

The launch field is the Proof release plus syndication clones, one directory summary, and stale explainers written against the superseded v0.1 header names. None of them: (1) reads the current Draft 0.2.0 header set against a live endpoint; (2) separates the identity layer from the judgment layer; (3) tests whether any production x402 endpoint actually presents an x401 surface today. This page does all three, with the probe reproducible in one curl.

Do it yourself

Read the current draft, not a summary: https://x401.proof.com/spec/latest/ — spec status is Draft 0.2.0, and 0.2.0 was a breaking redesign of 0.1.0 (old header names are stale).
Audit your own 402 endpoint the way we did: curl -s -D - -o /dev/null -X POST <your-endpoint> and list the exposed headers. If only PAYMENT-* appears, your identity layer is out-of-band — say so in your docs instead of implying it.
Put proof before payment in the flow: 401 + PROOF-REQUEST for the credential/mandate, gate-score the signed terms, then 402 + x402 for settlement.
Retain the signed evidence with the decision receipt. When a purchase is disputed, the mandate proves what was approved and the receipt proves what the gate scored — neither substitutes for the other.

Honest caveats

x401 is a draft (0.2.0), not a finished standard; Proof says it intends neutral, independent governance — that has not happened yet.
SML has not implemented x401. Today's probe is a gap measurement, not a product claim; our stack is x402 + decision gate only.
Proof's "first company into production" framing and the Superfluid early-adopter claim are Proof's own statements in its launch release, labeled as such above.
A mandate's scope is only as good as its drafting: an over-broad signed approval authorizes over-broad agent action, cryptographically valid and still wrong — the gate's confirm/escalate bands exist for that case.

Claim Receipts

Claim	Source
Probe result: /decide 402, PAYMENT-REQUIRED/PAYMENT-RESPONSE exposed, zero PROOF-* headers; /health 200 in 4.09s; agent.json LIVE_SETTLEMENT_VERIFIED with $0.25/$0.01 tiers, Base, payTo	Direct curl probes this run, 2026-10-16 ~09:20 EDT (single measurements, not averages)
CDP discovery pagination total 43,089 (limit=100) vs 37,267 Oct 14, same endpoint/method	CDP discovery probe this run + 2026-10-14 evening log addendum
Spec Draft 0.2.0, three PROOF-* headers, DC API/OpenID4VP carriage, payment explicitly out of scope, Apache 2.0	x401.proof.com spec index + proof/x401 GitHub README, read 2026-10-16
Production launch contents, identity wallet mechanics, per-claim payment over x402, Superfluid early adopter, Amazon/Muse context, FinCEN guidance date	Proof launch release via GlobeNewswire, Oct 15, 2026 — vendor statements labeled as such on the page
Directory counts: 1,021 listed / 959 payment-ready / 13 delivery-verified	x402-list.com/state-of-x402, read 2026-10-16 — that directory's own measurement