# HTTP Message Signatures vs Signature Agent Card (Web Bot Auth registry)

Both belong to the Web Bot Auth family group on this map. The map lists them as complementary: sites and agents commonly implement both. HTTP Message Signatures is a prerequisite of Signature Agent Card (Web Bot Auth registry).

[2 Identify](/category/identify/) [HTTP Message Signatures](/protocols/http-message-signatures/) · [2 Identify](/category/identify/) [Signature Agent Card (Web Bot Auth registry)](/protocols/web-bot-auth-signature-agent-card/)

|  | [HTTP Message Signatures](/protocols/http-message-signatures/) | [Signature Agent Card (Web Bot Auth registry)](/protocols/web-bot-auth-signature-agent-card/) |
| --- | --- | --- |
| Lifecycle step | 2 Identify: Who is this agent? Who is this site? | 2 Identify: Who is this agent? Who is this site? |
| Answers | How can HTTP messages carry end-to-end component integrity and proof of possession, independent of transport-layer security? | What identity, purpose, rate expectations and cryptographic keys belong to a signed bot? |
| Governed by | IETF | IETF individual draft, discussed on the web-bot-auth@ietf.org list; not yet adopted by the webbotauth WG (unlike the sibling httpsig-protocol draft) |
| Status (issuer's words) | Proposed Standard | Active Internet-Draft (individual), Intended Status: Informational |
| Phase | stable | draft |
| Version | RFC 9421, February 2024, Proposed Standard (2024-02) | draft-meunier-webbotauth-registry-03, 2026-06-26 (2026-06-26) |
| Form / transport | HTTP header | document format |
| Found at | none | /.well-known/http-message-signatures-directory |
| Adoption | observed — Multiple libraries and at least one profile in production use (Web Bot Auth / Cloudflare); RFC 9421 is a general-purpose base standard, not agent-specific | unmeasured |
| Evidence | 2 verified | 2 verified |
| Primary use case | Prove an agent's identity | Prove an agent's identity |
| Last verified | 2026-10-16 (current) | 2026-10-18 (current) |
| Specification | [https://www.rfc-editor.org/info/rfc9421](https://www.rfc-editor.org/info/rfc9421) | [https://datatracker.ietf.org/doc/draft-meunier-webbotauth-registry/](https://datatracker.ietf.org/doc/draft-meunier-webbotauth-registry/) |

## When to use which

- Choose HTTP Message Signatures when your question is “How can HTTP messages carry end-to-end component integrity and proof of possession, independent of transport-layer security?” and you accept its maturity: phase stable, adoption observed (Multiple libraries and at least one profile in production use (Web Bot Auth / Cloudflare); RFC 9421 is a general-purpose base standard, not agent-specific).
- Choose Signature Agent Card (Web Bot Auth registry) when your question is “What identity, purpose, rate expectations and cryptographic keys belong to a signed bot?” and you accept its maturity: phase draft, adoption unmeasured.

Guidance is derived from the two records (question, phase, adoption, prerequisites, pairings), not from opinion. Each record's page carries its numbered references.

## Read the full articles

- [HTTP Message Signatures](/protocols/http-message-signatures/): How can HTTP messages carry end-to-end component integrity and proof of possession, independent of transport-layer security?
- [Signature Agent Card (Web Bot Auth registry)](/protocols/web-bot-auth-signature-agent-card/): What identity, purpose, rate expectations and cryptographic keys belong to a signed bot?

Ask the MCP server to compare any two: the compare-protocols prompt, or get on both ids. [Connect](/connect/).

[http-message-signatures.json](/data/protocols/http-message-signatures.json) · [web-bot-auth-signature-agent-card.json](/data/protocols/web-bot-auth-signature-agent-card.json) · [Markdown](/compare/http-message-signatures-vs-web-bot-auth-signature-agent-card/index.md)