Web Bot Auth · RFC 9421 · Ed25519

Signature & directory debugger

Paste a signed request or enter a domain and see exactly what passes, what fails, and why. See who publishes agent identity →

We asked eight AI assistants to fetch one instrumented page. Six sent a request, none signed it, and three could not be identified by the method their own operator publishes. Read the study →

Domain

Try

Fetches /.well-known/http-message-signatures-directory and grades every key against the drafts + JWK RFCs.

Target URL (the request's @target-uri)

Method

Signature-Agent (optional)

Signature-Input header Signature header Public JWK (optional, otherwise resolved from the directory by keyid)

We reconstruct the exact RFC 9421 signature base, resolve the key from the operator's directory, and tell you which check fails.

The observatory of AI agent identity. Built on Cloudflare's open web-bot-auth. IETF webbotauth WG · RFC 9421