> For the complete documentation index, see [llms.txt](https://docs.zetrix.com/en/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.zetrix.com/en/developer-resources/agentic-wallet/protocol-flow/baseline-flow.md).

# Baseline flow (identity only)

<figure><img src="https://1469461171-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXcoJUOiksWSVn1v6flsh%2Fuploads%2Fgit-blob-b18d4c7d6f7c4cb8bb6ef1a311b86f75d7b88f06%2Fbaseline-flow.png?alt=media" alt=""><figcaption><p>x401 baseline flow: identity only</p></figcaption></figure>

* **Request.** Agent requests a protected resource with no proof.
* **Challenge.** The X401 SDK returns 401 Unauthorized (`Cache-Control: no-store`) with the challenge carrying the credential requirement, including a verifier challenge/nonce.
* **Presentation acquisition.** The agent forwards the embedded OpenID4VP request (JAR), DCQL and challenge intact, to the Agentic Wallet MCP. The MCP selects credentials, **derives the SD proof in software** (BBS+/range), and requests a **holder-binding signature from the HSM via the Wallet BE**, with the verifier challenge threaded into the signed material (Ed25519 nonce binding).
* **Retry.** Agent submits the proof artifact to `POST /presentation/submit`.
* **Verify & respond.** The OID4VP Verifier validates **in-process**, signature, BBS+, range-proof, DCQL, status, nonce/audience, resolving issuer keys from the on-chain ZID Registry. Result delivery is **sync-HMAC** (inline) or **callback**.