Signature Agent Card (Web Bot Auth registry) vs Web Bot Auth HTTP Message Signatures
Both belong to the Web Bot Auth family group on this map. The map lists them as complementary: sites and agents commonly implement both. Web Bot Auth HTTP Message Signatures is a prerequisite of Signature Agent Card (Web Bot Auth registry).
| Signature Agent Card (Web Bot Auth registry) | Web Bot Auth HTTP Message Signatures WebBotAuth | |
|---|---|---|
| Lifecycle step | 2 Identify: Who is this agent? Who is this site? | 2 Identify: Who is this agent? Who is this site? |
| Answers | What identity, purpose, rate expectations and cryptographic keys belong to a signed bot? | Which automated client made this HTTP request, and can the origin verify it cryptographically? |
| Governed by | IETF individual draft, discussed on the web-bot-auth@ietf.org list; not yet adopted by the webbotauth WG (unlike the sibling httpsig-protocol draft) | IETF webbotauth Working Group (chartered; document adopted as a WG item 2026-09-01) |
| Status (issuer's words) | Active Internet-Draft (individual), Intended Status: Informational | Active Internet-Draft, WG Document, Intended Status: Informational |
| Phase | draft | working group |
| Version | draft-meunier-webbotauth-registry-03, 2026-06-26 (2026-06-26) | draft-ietf-webbotauth-httpsig-protocol-00, adopted by the webbotauth WG, last updated 2026-09-01 (supersedes the individual draft-meunier-webbotauth-httpsig-protocol-00 of 2026-06-26) (2026-09-01) |
| Form / transport | document format | HTTP header |
| Found at | /.well-known/http-message-signatures-directory | /.well-known/http-message-signatures-directory |
| Adoption | unmeasured | observed — Cloudflare (edge verification, verified-bots program) and independent client/server implementations listed in the draft's own appendix |
| Evidence | 2 verified | 3 verified |
| Primary use case | Prove an agent's identity | Prove an agent's identity |
| Last verified | 2026-10-18 (current) | 2026-10-18 (current) |
| Specification | https://datatracker.ietf.org/doc/draft-meunier-webbotauth-registry/ | https://datatracker.ietf.org/doc/draft-ietf-webbotauth-httpsig-protocol/ |
When to use which
- Choose Signature Agent Card (Web Bot Auth registry) when your question is “What identity, purpose, rate expectations and cryptographic keys belong to a signed bot?” and you accept its maturity: phase draft, adoption unmeasured.
- Choose Web Bot Auth HTTP Message Signatures when your question is “Which automated client made this HTTP request, and can the origin verify it cryptographically?” and you accept its maturity: phase working group, adoption observed (Cloudflare (edge verification, verified-bots program) and independent client/server implementations listed in the draft's own appendix).
Read the full articles
- Signature Agent Card (Web Bot Auth registry): What identity, purpose, rate expectations and cryptographic keys belong to a signed bot?
- Web Bot Auth HTTP Message Signatures: Which automated client made this HTTP request, and can the origin verify it cryptographically?
web-bot-auth-signature-agent-card.json · webbotauth.json · Markdown