x401

x401 introduces an HTTP-native, route-scoped protocol designed to mandate credential-based proof for controlling access to protected resources. This protocol facilitates the secure exchange of credentials through a machine-friendly mechanism, enabling agents to accurately represent the identities of the individuals or entities that govern them. The system extends HTTP's existing authentication framework by adding a “proof” layer, essential for the modern era of autonomous agents and delegated service identities. It moves beyond simple token-based access, allowing routes to determine what a caller can verifiably prove rather than just checking a token. This is crucial for applications requiring high assurance regarding the caller's identity or specific attributes, such as age verification, organizational affiliation, or legal identity conformance. x401 is built to support a wide range of use cases, including opening bank accounts with verified KYC/AML compliance, implementing step-up authentication for sensitive transactions, verifying patient identities for prescriptions, confirming board associations, age-gating access without revealing personal details, and selling tickets to verified persons instead of bots. It streamlines identity negotiation for the agentic web, ensuring robust and auditable access control. This protocol is ideal for developers and organizations building secure web services that interact with diverse agent identities and require granular, verifiable access control. It offers a standardized approach to proof-gated HTTP routes, integrating with established standards like OpenID4VP, DCQL, OAuth, and DIF Credential Trust Establishment.