# Web Bot Auth HTTP Message Signatures vs HTTP Message Signatures

Both belong to the Web Bot Auth family group on this map. The map lists them as complementary: sites and agents commonly implement both. HTTP Message Signatures is a prerequisite of Web Bot Auth HTTP Message Signatures.

[2 Identify](/category/identify/) [Web Bot Auth HTTP Message Signatures](/protocols/webbotauth/) · [2 Identify](/category/identify/) [HTTP Message Signatures](/protocols/http-message-signatures/)

|  | [Web Bot Auth HTTP Message Signatures](/protocols/webbotauth/) WebBotAuth | [HTTP Message Signatures](/protocols/http-message-signatures/) |
| --- | --- | --- |
| Lifecycle step | 2 Identify: Who is this agent? Who is this site? | 2 Identify: Who is this agent? Who is this site? |
| Answers | Which automated client made this HTTP request, and can the origin verify it cryptographically? | How can HTTP messages carry end-to-end component integrity and proof of possession, independent of transport-layer security? |
| Governed by | IETF webbotauth Working Group (chartered; document adopted as a WG item 2026-09-01) | IETF |
| Status (issuer's words) | Active Internet-Draft, WG Document, Intended Status: Informational | Proposed Standard |
| Phase | working group | stable |
| Version | draft-ietf-webbotauth-httpsig-protocol-00, adopted by the webbotauth WG, last updated 2026-09-01 (supersedes the individual draft-meunier-webbotauth-httpsig-protocol-00 of 2026-06-26) (2026-09-01) | RFC 9421, February 2024, Proposed Standard (2024-02) |
| Form / transport | HTTP header | HTTP header |
| Found at | /.well-known/http-message-signatures-directory | none |
| Adoption | observed — Cloudflare (edge verification, verified-bots program) and independent client/server implementations listed in the draft's own appendix | observed — Multiple libraries and at least one profile in production use (Web Bot Auth / Cloudflare); RFC 9421 is a general-purpose base standard, not agent-specific |
| Evidence | 3 verified | 2 verified |
| Primary use case | Prove an agent's identity | Prove an agent's identity |
| Last verified | 2026-10-18 (current) | 2026-10-16 (current) |
| Specification | [https://datatracker.ietf.org/doc/draft-ietf-webbotauth-httpsig-protocol/](https://datatracker.ietf.org/doc/draft-ietf-webbotauth-httpsig-protocol/) | [https://www.rfc-editor.org/info/rfc9421](https://www.rfc-editor.org/info/rfc9421) |

## When to use which

- Choose Web Bot Auth HTTP Message Signatures when your question is “Which automated client made this HTTP request, and can the origin verify it cryptographically?” and you accept its maturity: phase working group, adoption observed (Cloudflare (edge verification, verified-bots program) and independent client/server implementations listed in the draft's own appendix).
- Choose HTTP Message Signatures when your question is “How can HTTP messages carry end-to-end component integrity and proof of possession, independent of transport-layer security?” and you accept its maturity: phase stable, adoption observed (Multiple libraries and at least one profile in production use (Web Bot Auth / Cloudflare); RFC 9421 is a general-purpose base standard, not agent-specific).

Guidance is derived from the two records (question, phase, adoption, prerequisites, pairings), not from opinion. Each record's page carries its numbered references.

## Read the full articles

- [Web Bot Auth HTTP Message Signatures](/protocols/webbotauth/): Which automated client made this HTTP request, and can the origin verify it cryptographically?
- [HTTP Message Signatures](/protocols/http-message-signatures/): How can HTTP messages carry end-to-end component integrity and proof of possession, independent of transport-layer security?

Ask the MCP server to compare any two: the compare-protocols prompt, or get on both ids. [Connect](/connect/).

[webbotauth.json](/data/protocols/webbotauth.json) · [http-message-signatures.json](/data/protocols/http-message-signatures.json) · [Markdown](/compare/webbotauth-vs-http-message-signatures/index.md)