# Signature Agent Card (Web Bot Auth registry)

[2 · Identify](/category/identify/)

| Signature Agent Card (Web Bot Auth registry) |
| --- |
| Category | [Identify](/category/identify/) |
| Governed by | IETF individual draft, discussed on the web-bot-auth@ietf.org list; not yet adopted by the webbotauth WG (unlike the sibling httpsig-protocol draft) |
| Status | Active Internet-Draft (individual), Intended Status: Informational |
| Phase | draft |
| Implementation | prototype |
| Adoption | unmeasured |
| Version | draft-meunier-webbotauth-registry-03, 2026-06-26 (2026-06-26) |
| Specification | [https://datatracker.ietf.org/doc/draft-meunier-webbotauth-registry/](https://datatracker.ietf.org/doc/draft-meunier-webbotauth-registry/) |
| Found at | /.well-known/http-message-signatures-directory |
| Last checked | 2026-09-06 |

[Identify](/category/identify/) This draft defines the "Signature Agent Card": a JSON metadata document that a Web Bot Auth signer (a crawler, agent, or bot operator) publishes to describe itself — its identity, purpose, expected request rate, and cryptographic keys [[1]](#ref-1). Rather than inventing a new schema, it reuses the OAuth Dynamic Client Registration Metadata field set (client_id, client_name, client_uri, logo_uri, contacts, jwks_uri/jwks) and extends it with a single web_bot_auth object (fields observed in the spec include expected-user-agent, an RFC 9309 robots.txt product token, a trigger type such as "fetcher", and a purpose such as "tdm" for text-and-data-mining) [[1]](#ref-1). The same document also formally establishes an IANA registry for that web_bot_auth object's members, so third parties can register new fields.

## Overview
It solves the metadata gap left by the base Web Bot Auth signature protocol: RFC 9421 signatures and the Signature-Agent header prove that a request was signed by a given key, but not who holds that key, why they are crawling, or how fast they intend to request — this card supplies that context in a machine-readable form at the same well-known path used for the key directory [[1]](#ref-1). It does not itself carry the cryptographic proof (that is RFC 9421 plus the base Web Bot Auth protocol) and does not define enforcement — a site is free to ignore the declared purpose or rate.

Current state: an individual Internet-Draft, draft-meunier-webbotauth-registry-03, published 2026-06-26, authored by engineers at Cloudflare and Amazon [[1]](#ref-1). As of this check (2026-09-06) it has not been adopted by the newly chartered IETF webbotauth Working Group, unlike its sibling protocol draft, which was adopted as a WG document on 2026-09-01 [[2]](#ref-2). Its examples show the same well-known path (/.well-known/http-message-signatures-directory) can list multiple signer cards — individual bots as well as "platform" gateways that sign on behalf of several downstream operators.

Implementers: as an Informational registry-and-schema draft rather than a running protocol, no dedicated client/server implementations beyond the base Web Bot Auth signing/verifying stack (Cloudflare's libraries, see the sibling httpsig-protocol record) were found in this pass; none is claimed in the draft itself.

Disputed or unknown: whether this draft will be folded into the WG's adopted protocol document or remain a separate track, and how much of the web_bot_auth extension object will change before any WG adoption, are both open.

## Discovery and probe

jwks_uri client-metadata field (or a plain client_id JSON document) resolvable at a well-known path · /.well-known/http-message-signatures-directory

```
GET https://{origin}/.well-known/http-message-signatures-directory
parse:     JSON object with OAuth Dynamic Client Registration fields (client_id, client_name, client_uri, jwks_uri or jwks, contacts) plus a web_bot_auth extension object (e.g. expected-user-agent, rfc9309-product, trigger, purpose)
on absent: No Signature Agent Card is published; a verifier can still validate the raw signature via the plain key directory but has no machine-readable identity, purpose or rate-limit metadata for the signer
```

Live check run by [the MCP probe](/mcp/server-card): GET /.well-known/http-message-signatures-directory. The Signature Agent Card adds OAuth client registration fields to the directory.

```
{
 "path": "/.well-known/http-message-signatures-directory",
 "expect": {
  "json_keys": [
   "client_name"
  ]
 },
 "note": "The Signature Agent Card adds OAuth client registration fields to the directory."
}
```

## History
- 2026-09-05 — seeded from Exa Agent research run
- 2026-09-06 — verified against draft-meunier-webbotauth-registry-03 primary text and its current datatracker status page

## Instances

- [wba (managed Web Bot Auth directory server)](https://github.com/calvernaz/wba) · Observed 2026-04-13 · service

Every instance with its source is listed on the [instances page](/instances/).

## See also

- [Web Bot Auth HTTP Message Signatures](/protocols/webbotauth/)
- [HTTP Message Signatures](/protocols/http-message-signatures/)

## References

- The draft defines the Signature Agent Card as a JSON metadata document reusing OAuth Dynamic Client Registration Metadata fields extended with a single web_bot_auth object, and registers that object with IANA — [https://www.ietf.org/archive/id/draft-meunier-webbotauth-registry-03.html](https://www.ietf.org/archive/id/draft-meunier-webbotauth-registry-03.html) (2026-06-26) VERIFIED
- As of this check the document remains an individual submission (not yet a webbotauth WG document), unlike the sibling httpsig-protocol draft which was WG-adopted on 2026-09-01 — [https://datatracker.ietf.org/doc/draft-meunier-webbotauth-registry/](https://datatracker.ietf.org/doc/draft-meunier-webbotauth-registry/) (2026-09-06) VERIFIED

Disputed: The seed record's name implied this was the identity card format only; the draft text shows it also functions as the IANA registry establishment document for the web_bot_auth metadata namespace, and its examples show operators listing multiple bot/platform cards (crawlers, gateways) at a shared discovery path, not just one card per origin.

[JSON](/data/protocols/web-bot-auth-signature-agent-card.json) · [Markdown](/protocols/web-bot-auth-signature-agent-card/index.md)