Web Bot Auth · RFC 9421 · Ed25519

Signature & directory debugger

Paste a signed request or enter a domain and see exactly what passes, what fails, and why. See who publishes agent identity →

Domain

Try

Fetches /.well-known/http-message-signatures-directory and grades every key against the drafts + JWK RFCs.

Target URL (the request's @target-uri)

Method

Signature-Agent (optional)

Signature-Input header Signature header Public JWK (optional — otherwise resolved from the directory by keyid)

We reconstruct the exact RFC 9421 signature base, resolve the key from the operator's directory, and tell you which check fails.

The observatory of AI agent identity. Built on Cloudflare's open web-bot-auth. IETF webbotauth WG · RFC 9421