Web Bot Auth key directory published

What we check

Web Bot Auth is an IETF working group draft (draft-ietf-webbotauth-httpsig-protocol-00, dated 2026-09-01 and still the current revision when we re-checked on 2026-09-22) for signing automated HTTP requests. A party that signs its requests publishes its public keys at /.well-known/http-message-signatures-directory, as a JSON Web Key Set served with the media type application/http-message-signatures-directory+json. We check that your domain serves such a directory, that it contains at least one usable Ed25519 signing key, and that the key is inside its validity window. We check publication only: we do not verify any signatures, and we do not check that each kid is the key's thumbprint.

Why it matters

Signed requests are an emerging way to tell a genuine agent from an impostor. A directory at your domain shows you have adopted the draft's key format; as the draft is still changing, treat it as early groundwork.

How we check

We request /.well-known/http-message-signatures-directory once.

PASS: HTTP 200, a JSON object with a keys array, at least one key with kty OKP, crv Ed25519 and a non-empty x, with use absent or "sig" and key_ops absent or including "verify", inside its nbf/exp window, served as application/http-message-signatures-directory+json. WARN: the body is not JSON; it is JSON but not a key set; none of the keys is a usable Ed25519 signing key; every Ed25519 key has expired or is not yet valid; or the directory is served with a different media type, such as application/json. FAIL: the path returns anything other than 200 (for example 404), or returns your site's own HTML page. SKIPPED: our request was refused before it was answered, or bot management answered instead of your shop.

How to fix it

1. Publish an Ed25519 JSON Web Key Set at /.well-known/http-message-signatures-directory with the media type application/http-message-signatures-directory+json.
2. Give each key a use of "sig" and keep its nbf/exp window current; rotate keys before they expire.
3. Re-read draft-ietf-webbotauth-httpsig-protocol before implementing; the header set and directory format are still changing.

What good looks like

GET /.well-known/http-message-signatures-directory

HTTP/1.1 200 OK
Content-Type: application/http-message-signatures-directory+json

{
  "keys": [
    {
      "kty": "OKP",
      "crv": "Ed25519",
      "kid": "<RFC 7638 JWK thumbprint>",
      "x": "<base64url-encoded public key>",
      "use": "sig",
      "nbf": 1767225600,
      "exp": 1798761600
    }
  ]
}

Sources

• IETF draft-ietf-webbotauth-httpsig-protocol-00 (working group draft, 2026-09-01)
• Cloudflare web-bot-auth reference implementation

Read more

• Bots, crawlers and agents: who is knocking

  A User-Agent string can be spoofed, and robots.txt rules are a request to crawlers rather than access authorization. Web Bot Auth, an IETF draft, would let an agent sign its requests so a server can verify who sent them.