What is the difference between HTTP Message Signatures and Signature Agent Card (Web Bot Auth registry)?

Both belong to the Web Bot Auth family group on this map. The map lists them as complementary: sites and agents commonly implement both. HTTP Message Signatures is a prerequisite of Signature Agent Card (Web Bot Auth registry). HTTP Message Signatures answers: How can HTTP messages carry end-to-end component integrity and proof of possession, independent of transport-layer security? Signature Agent Card (Web Bot Auth registry) answers: What identity, purpose, rate expectations and cryptographic keys belong to a signed bot?

When should I use HTTP Message Signatures instead of Signature Agent Card (Web Bot Auth registry)?

Choose HTTP Message Signatures when your question is “How can HTTP messages carry end-to-end component integrity and proof of possession, independent of transport-layer security?” and you accept its maturity: phase stable, adoption observed (Multiple libraries and at least one profile in production use (Web Bot Auth / Cloudflare); RFC 9421 is a general-purpose base standard, not agent-specific). Choose Signature Agent Card (Web Bot Auth registry) when your question is “What identity, purpose, rate expectations and cryptographic keys belong to a signed bot?” and you accept its maturity: phase draft, adoption unmeasured.

HTTP Message Signatures vs Signature Agent Card (Web Bot Auth registry)

Both belong to the Web Bot Auth family group on this map. The map lists them as complementary: sites and agents commonly implement both. HTTP Message Signatures is a prerequisite of Signature Agent Card (Web Bot Auth registry).

2 Identify HTTP Message Signatures · 2 Identify Signature Agent Card (Web Bot Auth registry)

	HTTP Message Signatures	Signature Agent Card (Web Bot Auth registry)
Lifecycle step	2 Identify: Who is this agent? Who is this site?	2 Identify: Who is this agent? Who is this site?
Answers	How can HTTP messages carry end-to-end component integrity and proof of possession, independent of transport-layer security?	What identity, purpose, rate expectations and cryptographic keys belong to a signed bot?
Governed by	IETF	IETF individual draft, discussed on the web-bot-auth@ietf.org list; not yet adopted by the webbotauth WG (unlike the sibling httpsig-protocol draft)
Status (issuer's words)	Proposed Standard	Active Internet-Draft (individual), Intended Status: Informational
Phase	stable	draft
Version	RFC 9421, February 2024, Proposed Standard (2024-02)	draft-meunier-webbotauth-registry-03, 2026-06-26 (2026-06-26)
Form / transport	HTTP header	document format
Found at	none	/.well-known/http-message-signatures-directory
Adoption	observed — Multiple libraries and at least one profile in production use (Web Bot Auth / Cloudflare); RFC 9421 is a general-purpose base standard, not agent-specific	unmeasured
Evidence	2 verified	2 verified
Primary use case	Prove an agent's identity	Prove an agent's identity
Last verified	2026-10-16 (current)	2026-10-18 (current)
Specification	https://www.rfc-editor.org/info/rfc9421	https://datatracker.ietf.org/doc/draft-meunier-webbotauth-registry/

When to use which

Choose HTTP Message Signatures when your question is “How can HTTP messages carry end-to-end component integrity and proof of possession, independent of transport-layer security?” and you accept its maturity: phase stable, adoption observed (Multiple libraries and at least one profile in production use (Web Bot Auth / Cloudflare); RFC 9421 is a general-purpose base standard, not agent-specific).
Choose Signature Agent Card (Web Bot Auth registry) when your question is “What identity, purpose, rate expectations and cryptographic keys belong to a signed bot?” and you accept its maturity: phase draft, adoption unmeasured.

Guidance is derived from the two records (question, phase, adoption, prerequisites, pairings), not from opinion. Each record's page carries its numbered references.

Read the full articles

HTTP Message Signatures: How can HTTP messages carry end-to-end component integrity and proof of possession, independent of transport-layer security?
Signature Agent Card (Web Bot Auth registry): What identity, purpose, rate expectations and cryptographic keys belong to a signed bot?

Ask the MCP server to compare any two: the compare-protocols prompt, or get on both ids. Connect.

http-message-signatures.json · web-bot-auth-signature-agent-card.json · Markdown