Arches Bank

Member FDIC • x407 Proxy Authentication Required Demo

Online Banking / Account Access / Secure Verification

About This Demo

The x407 Proxy Authentication Required protocol enables secure authentication using Verifiable Digital Credentials (VDCs).

Future work: AI agent delegation with token-based authentication

x407 Protocol Flow

Client requests protected resource → GET /api/accounts/transactions
Server returns authentication required → 401 or 407 + X-Proxy-Auth-Required header
- Status code depends on user agent capabilities
- Header includes resource.url (where to send authenticated request)
- Includes nonce, accepted schemes, and required credential fields
User reviews and approves credential request
Client initiates credential presentation → Launches digital wallet flow
Client retries with authentication → Request to URL from resource.url + X-Proxy-Auth header containing credential presentation
Server validates and responds → 200 OK + X-Proxy-Auth-Response header + protected resource

Similar to x402 for payments, x407 provides a standardized challenge-response authentication flow with verifiable credentials.

Future Work: x407 as x402 Extension

x407 authentication could potentially be integrated into x402 payment flows via the extensions field, enabling identity verification before payment authorization. This would allow both human users and AI agents to authenticate before completing financial transactions. This integration pattern remains future work.

{
  "x402Version": 2,
  "payment": {...},
  "extensions": {
    "x407": {
      "required": true,
      "accepts": ["credential"],
      "requiredFields": ["given_name", "family_name"]
    }
  }
}

Secure Digital Identity Verification

Access Your Financial Records

Under CFPB Section 1033, you have the right to access your transaction history, account balances, and financial data. Verify your identity with Verifiable Digital Credentials (VDCs) like State-Endorsed Digital IDs.

Privacy-Preserving Authentication

Your credential stays on your device. Only the fields required for authentication are shared; no unnecessary data leaves your control.