HTTP Message Signatures

2 · Identify

HTTP Message Signatures
Category	Identify
Governed by	IETF
Status	Proposed Standard
Phase	stable
Implementation	multi-implementation
Adoption	observed — Multiple libraries and at least one profile in production use (Web Bot Auth / Cloudflare); RFC 9421 is a general-purpose base standard, not agent-specific
Version	RFC 9421, February 2024, Proposed Standard (2024-02)
Specification	https://www.rfc-editor.org/info/rfc9421
Found at	none
Last checked	2026-09-06

Identify RFC 9421 (HTTP Message Signatures) is a general-purpose IETF Proposed Standard, not specific to agents. It defines how to create, encode and verify digital signatures or message authentication codes over selected components of an HTTP message (headers, derived components like @authority or @method, and optionally the body), so that a signature survives intermediaries that might otherwise alter or drop parts of the message ^[1]. It also defines how to request that a future message in an ongoing exchange be signed ^[1].

Overview

It solves message-level integrity and proof-of-possession for HTTP independent of transport security (TLS terminates at intermediaries; RFC 9421 signatures do not) ^[1]. It does not define identity discovery, key distribution, or any notion of "bot" or "agent" — those are added by profiles built on top of it. In this map, it is the base standard that Web Bot Auth (see the webbotauth record) profiles: Web Bot Auth adds the Signature-Agent header as a signed component and defines a specific key-discovery mechanism (a well-known JWKS directory), while RFC 9421 itself stays agnostic to what a signature proves or where keys come from ^[2].

Current state: published as a Proposed Standard in February 2024 and stable since; it is not itself under active revision as far as this check found.

Who implements it: general HTTP signing libraries exist across languages (this check did not re-survey the full ecosystem); its most visible agent-relevant use is as the substrate for Web Bot Auth, which Cloudflare verifies at the edge ^[2].

Disputed or unknown: none specific to the base standard found in this pass. Because RFC 9421 is general and widely referenced, this record exists mainly to anchor the agent-specific profiles (Web Bot Auth, and potentially others) that depend on it; it should not be read as agent-specific adoption evidence on its own.

Discovery and probe

Signature and Signature-Input HTTP fields carried directly on the message; no fixed discovery path of its own · none

GET n/a — inspect response/request headers on any HTTP exchange
parse:     Presence of Signature and Signature-Input HTTP fields (or their Content-Digest/Signature-related trailers) conforming to RFC 9421's structured-field syntax
on absent: The message carries no RFC 9421 signature; any profile built on it (e.g. Web Bot Auth) cannot be verified

Not probed live: no-fixed-path. Signatures appear on individual messages; the webbotauth directory rule covers the published key side.

History

2026-09-05 — seeded from Exa Agent research run
2026-09-06 — verified against RFC 9421 primary source and confirmed as the base standard profiled by Web Bot Auth

Instances

No instances recorded yet.

References

RFC 9421 is a Proposed Standard published by the IETF (2024) defining a mechanism for creating, encoding and verifying signatures over HTTP message components, including a means to request that a signature be applied to a subsequent message — https://www.rfc-editor.org/info/rfc9421 (2024-02) VERIFIED
Web Bot Auth's protocol draft explicitly builds its Agent/Origin signature exchange on top of RFC 9421's Signature and Signature-Input fields, adding the Signature-Agent field as an RFC 9421 signature component — https://datatracker.ietf.org/doc/html/draft-meunier-webbotauth-httpsig-protocol-00 (2026-06-26) VERIFIED

JSON · Markdown