HTTP Message Signatures
A standard, RFC 9421, for signing HTTP requests so a server can verify who sent them. Web Bot Auth applies it to crawlers: the operator publishes a key directory, signs each request, and a site can verify the signature instead of trusting a user-agent string or an IP list.
What HTTP Message Signatures does not show
It answers who sent the request, not whether they may have what they asked for.
Where HTTP Message Signatures comes up on this site
- Web Bot Auth: how signed crawler and agent requests are verifiedJWKS of public keys, itself signed The building blocks Web Bot Auth is defined in IETF Internet-Drafts and builds on RFC 9421, HTTP Message Signatures, which specifies how to sign selected parts of an HTTP message.
- How an AI agent should verify a website before acting on itWhen the domain sends its own agents, signed requests under Web Bot Auth (built on RFC 9421 HTTP Message Signatures ) identify them better than a user agent string anyone can type.
- Who signs their agent requests? Web Bot Auth in October 2026Anthropic’s and Perplexity’s crawler pages were read for any mention of Web Bot Auth, HTTP message signatures or Signature-Agent and contain none.
Terms this definition uses
Related terms in Machine files
The files addressed to machines rather than readers, and what publishing one does and does not buy.
llms.txt · llms-full.txt · agents.md · entity map · entity map parity · machine layer · well-known URI · MCP · agent card · sitemap index · OpenAPI specification · ai.txt · Tool definition · SKILL.md · sitemap origin error · soft 404 on a machine file · tdmrep.json · TDM exception · security.txt · Content Signals · changefreq and priority · staging leak · host duplicate
Questions about HTTP Message Signatures
What is HTTP Message Signatures?
A standard, RFC 9421, for signing HTTP requests so a server can verify who sent them. Web Bot Auth applies it to crawlers: the operator publishes a key directory, signs each request, and a site can verify the signature instead of trusting a user-agent string or an IP list.
What does HTTP Message Signatures not show or guarantee?
It answers who sent the request, not whether they may have what they asked for.
Which area of the glossary does HTTP Message Signatures belong to?
Machine files: The files addressed to machines rather than readers, and what publishing one does and does not buy.
← Content Signals · changefreq and priority →
See it in the full glossary · 731 terms across 19 areas.