Accepts an x401 payload (https://x401.proof.com/spec/latest/#x401-payload) that wraps a Digital Credentials API request (https://www.w3.org/TR/digital-credentials/#DC-API) using the openid4vp-v1-signed protocol, and processes it as an OID4VP presentation request for the End-User identified by the login_hint claim of the signed request object. When the request carries a Proof access token issued to an End-User in the Authorization: Bearer header, that End-User is used instead of login_hint, and an invalid token is rejected with invalid_token.

The real OID4VP request is carried inside the signed request object at credential_requirements.digital.requests[0].data.request: a compact JWS with typ header oauth-authz-req+jwt, signed with ES256 by a key whose JWK is registered on your OAuth Application. Your client_id is conveyed by the request object's iss/client_id claims. Its response_mode must be dc_api. It must carry an exp claim at most one hour ahead and a unique jti claim; a request object is accepted once.

On success Proof returns a request_uri suitable for presenting to the End-User via their AI agent. Supply a top-level return_uri to use the x401 intermediary return channel (https://x401.proof.com/spec/latest/#return-channel); its origin must appear in the request object's expected_origins.

AI agents that cannot receive the presentation themselves omit return_uri and send an access token with the agentic scope. This requires the request object's expected_origins to be the agents trust list. Proof then also returns a result_polling_uri the agent polls with the same access token.