Make agents prove who sent them before your store says yes

An AI agent reaches your checkout. It has a working card. Maybe it has a customer's login. Your store can see that it can pay. It can't see who sent it, or whether that person agreed to this exact order.

On Oct 15, Proof launched x401, an open protocol that lets a site ask an agent exactly that. Worth an afternoon this week, on one route.

A card proves the agent can pay. It says nothing about who agreed to the order.

The gap Proof is pointing at

Proof's launch post puts it in two sentences: "An agent may possess a valid password, OAuth token, API key or payment card. None establishes that the person behind it authorized a particular action."

Proof calls this the Agent Evidentiary Gap. Its example is Amazon. Per Proof, Meta released Muse on Sept 8, and on Sept 21 Amazon blocked it, citing concerns that the agent didn't identify itself, appeared to collect customer credentials, and moved through accounts and transactions without Amazon's knowledge or consent.

Blocking is one answer. Asking for proof is another.

How x401 works, in plain terms

Your site gets a request from an agent on a route you care about. Instead of going ahead, it answers with a proof request in a dedicated HTTP header, PROOF-REQUEST. It can ask for verified identity claims, like legal name, age or country. It can also ask the person to sign the terms of this transaction.

The agent carries that request to the person. Per Proof, the person approves on their own device with a biometric, and their wallet signs. The agent retries with the result in a PROOF-RESPONSE header. Your site checks the issuer, the credential, the signature and the terms before it continues.

The part that matters for money: per Proof, "If the agent changes the amount, recipient or other signed terms, the signature no longer validates."

Proof says three pieces are live: the agent identity wallet, the x401 protocol, and an MCP server that works with Meta's Muse, ChatGPT dots, Grok, Claude and other MCP assistants.

Two details from the spec, version 0.2.0 as of this writing. It sits in its own headers, so it can run next to the login you already have on that route. And it stays out of payment: "When payment is required, it MUST be handled with HTTP 402 Payment Required and an appropriate payment protocol." The editors are from Proof and Circle. Listed reviewers include people from Okta, OpenAI and Visa.

The first route, in five moves

Get whoever owns the store and whoever owns the code in the same room.

1. Pick one route

One. Choose something irreversible that an agent could plausibly hit: an account email change, a large order, a refund to a new destination, a subscription change. If you can, start where a mistake is easy to undo.

Write down why that route. You'll want the reason when someone asks why checkout got a new step.

2. Ask for the smallest proof that settles a dispute

Two kinds of evidence are on the menu. Identity claims about the person, and a signature on the specific terms. Proof says basic claims, including verified age, country of residence and email, can be requested without a sales process, with the option to pay per claim over x402.

Start small. For a large order, a signature on the itemized terms may be all you need. For an account change, a verified identity claim may matter more. Every extra claim is one more thing a real customer has to approve on their phone.

3. Stand up the challenge

Proof points developers to proof.com/x401, with a reference implementation for Cloudflare Workers and guides for Node, Python and Go. Put the challenge on the route you picked, and nowhere else yet.

Then test it with an agent you control. Does it surface the request to a person? Does it come back with a valid response, or stall?

4. Decide what happens when the agent can't answer

Many agents may not handle this yet. The spec itself says consumer AI assistants from major platforms typically fetch pages through tools that drop or hide response headers, and it offers a body-embedded fallback that it labels "an early experiment."

So write the fallback before you turn it on. Send the shopper to your normal checkout with a human in the loop, or hold the action for review. Don't let a failed challenge become a silent dead end.

5. Keep the evidence with the order

Per Proof, the site can keep the signed evidence and validate it later if the transaction is disputed. Store it with the order or ticket: who it was, what they signed, when it expires, and which agent made the request.

If your own agents are the ones asking

Flip it around. If your Always On Agents buy from suppliers, open accounts or change settings on other sites, sooner or later one of those sites may send them a proof request.

Decide now whose wallet answers and how fast that person can be reached. A challenge that waits two days for the founder to see a notification is a stalled order. Note which agent made each request. That's one more reason to give each Always On Agent its own seat. And put "can be challenged" next to each money action on your agent's money map. While you're at it, audit the logins your agents already hold.

What this doesn't tell you

This is a vendor launch, and we haven't run a live x401 challenge against a production storefront. The spec is a draft and the version can move. Proof names Superfluid as an early production user; we haven't seen numbers on how many sites have adopted it. And nobody has shown yet whether x401, Shop Pay confirmation and issuer intent checks can stack in one checkout without asking the shopper three times.

It does give you a working way to ask an agent the two questions a card can't answer, on the routes where the answer matters.

This week

Pick the route. Write the smallest claim set. Read the spec once. Stand up the challenge in a test environment with your own agent. Write the fallback. Decide where the evidence lives. Date the page and revisit when the spec moves.

If you want signed proof wired into the routes your store and your agents rely on, get in touch.

Linked sources

• Proof: Proof launches x401, giving AI agents a way to prove who they represent and what they're authorized to do (2026-10-15)
• Proof: x401 HTTP Proof Requirement Protocol, version 0.2.0 draft
• Proof: x401 developer start page
• Related article: Give each Always On Agent its own seat, not your login
• Related article: Draw your agent's money map before you connect it
• Related article: Audit your agent's logins before your bank does