While traditional financial institutions remain locked in a cycle of blocking agentic traffic, the open-protocol ecosystem is demonstrating a functional alternative. On October 19, 2026, at Money20/20 USA, Proof and Circle jointly unveiled an end-to-end demo of an AI agent completing an identity-gated merchant purchase. This ‘Protocol Handshake’ bypasses the bank blockouts currently stalling the agent economy by replacing institutional gatekeeping with cryptographic verification.
The mechanics of the demo rely on the extension of two emerging standards: HTTP 401 (x401) for identity and HTTP 402 (x402) for payments. Beyond the two demo partners on stage, the release names Visa and Okta among x401’s ecosystem contributors, market weight the demo alone would not show. In the demonstration flow, a merchant returns an x401 request naming the specific identity fact required for the transaction. The agent then presents a selectively disclosed, NIST IAL2-certified Proof credential with a signed per-purchase authorization. Crucially, the merchant verifies the signature against Proof’s public keys without needing a live call to the identity provider or storing the agent’s full PII.
Settlement occurs over the x402 protocol using USDC from a Circle Agent Wallet. Unlike human card flows that require multiple rounds of redirection and consent, the x401/x402 handshake allows for machine-speed settlement while maintaining a tamper-evident audit trail. Pat Kinsel, Founder and CEO of Proof, described the shift: ‘The question isn’t whether agents can spend; it’s who vouches for the agent at the moment of the spend. By tying Kantara-certified credentials to the payment handshake, we give the merchant certainty without the agent needing a human to click approve.’
The significance of this demo lies in its decoupling of trust from centralized intermediaries. By using verifiable credentials to gate stablecoin purchases, Proof and Circle are providing a blueprint for agentic commerce that is vendor-neutral and highly scalable. As institutional agent volume grows, the ability to selectively disclose identity facts, rather than sharing entire profiles, will become the baseline for secure agent-to-merchant interactions.
For builders, this represents the emergence of the ‘trust layer’ that agents have previously lacked. The protocol-led approach ensures that as agents become the primary interface for internet-native commerce, the rails they run on are as autonomous and secure as the intelligence they provide.
