Web Bot Auth validator

Web Bot Auth lets an AI agent prove who it is by signing its requests (HTTP Message Signatures, RFC 9421) with a key published in a key directory. Building a signer? Paste a request here to see whether a website would accept it, check by check.

Request headersPaste Signature, Signature-Input, Signature-Agent (and any other covered headers).Key directory (optional)JWKS from the agent's /.well-known/http-message-signatures-directory. Leave empty to try fetching it.

Runs in your browser; nothing is sent to us.

Results appear here: every check from the draft, and the exact signature base your signer must produce.

Verify signatures on your server

POST any incoming request's method, URL and headers to our API and get valid / invalid back — with the keys of Google-Agent, ChatGPT, Browserbase and You.com built in.

Get a free API key10,000 checks/month free · Pro $19/month for 1M

What a valid request needs

Three headers: Signature, Signature-Input and Signature-Agent (a dictionary like agent1="https://your-agent.example"; the older bare-string form is still accepted by verifiers).
The signature must cover @authority (or @target-uri) and the Signature-Agent member, e.g. ("@authority" "signature-agent";key="agent1").
Parameters created, expires (≤ 24 h recommended), keyid = the base64url JWK SHA-256 thumbprint of your key, and tag="web-bot-auth".
Your public key in a JWKS at /.well-known/http-message-signatures-directory, served as application/http-message-signatures-directory+json.

Based on draft-ietf-webbotauth-httpsig-protocol-00 and the key directory draft; tested against the draft's official test vectors. It's still a draft, so details can change. New to it? Read Web Bot Auth explained. Running a website instead? See which bots really visit with the log checker.