AgentGrade

RFC 9421 — HTTP Message Signatures

Identity & trust · IETF · Updated 2026-07-19

Status: Proposed Standard (IETF), published February 2024 · Authoritative source

The cryptographic foundation of agent identity on the web: a standard way to sign HTTP requests so the receiver can verify who sent them — regardless of the User-Agent string, which anyone can fake.

RFC 9421 defines two HTTP fields. Signature-Input declares what was signed — a list of covered components plus parameters like key id and creation time. Signature carries the signature value itself. Covered components can be ordinary header fields or derived components describing the request itself: @method, @target-uri, @authority, @path, @query and friends (derived names always start with @).

Why it matters for the agentic web: user-agent strings are self-declared and freely spoofable, and IP-range lists are coarse and operationally painful. A signed request is neither — the signature either verifies against the operator’s published key or it doesn’t. This is the mechanism underneath Web Bot Auth, and it is already in production: OpenAI documents that its ChatGPT agent signs every outbound request per RFC 9421, sending Signature-Agent: "https://chatgpt.com" with verification keys published at https://chatgpt.com/.well-known/http-message-signatures-directory.

What a signed agent request looks like

GET /product/42 HTTP/1.1
Host: example.com
Signature-Agent: "https://chatgpt.com"
Signature-Input: sig1=("@authority" "signature-agent");created=1752900000;keyid="…";alg="ed25519"
Signature: sig1=:base64signature…:

How AgentGrade checks it

The scanner’s Web Bot Auth group checks whether a site publishes its own /.well-known/http-message-signatures-directory — the RFC 9421 key directory that lets other parties verify requests signed by your agents. Scan your site to see where you stand.

Related

All standards

RFC 9421 · Web Bot Auth · RFC 8615 · MCP · A2A · x402 · WebMCP · llms.txt · RFC 9309 · RFC 9110 · Index