What are HTTP Message Signatures?

By Nik Andreev, Founder & SEO specialist · Last reviewed · Editorial policy

HTTP Message Signatures is an IETF standard, RFC 9421 (February 2024), for signing chosen parts of an HTTP request or response, such as the host or specific headers. The sender lists what it signed in a Signature-Input header and puts the signature in a Signature header. The receiver rebuilds that input and checks it with the key.

At a glance

Standard
RFC 9421, Proposed Standard, published February 2024
Headers
Signature-Input, Signature (plus Accept-Signature to request one)
What gets signed
Chosen components: derived ones like @method, @authority, @path, plus named headers
Signature parameters
created, expires, nonce, alg, keyid, tag
Used by
Web Bot Auth, which profiles it for bots and AI agents

How it works

  • Pick components: the signer chooses what to cover, for example @authority (the host) and a header, and adds parameters like created, expires and keyid.
  • Sign: it builds a canonical signature base from those components and signs it, then sends Signature-Input (the list and parameters) and Signature (the bytes), both under the same label.
  • Verify: the receiver rebuilds the base from the request it received, looks up the key named by keyid, and checks the signature and the time window.
Signature-Input: sig=("@authority" "signature-agent");created=1700000000;expires=1700011111;keyid="ba3e64==";tag="web-bot-auth"
Signature: sig=:abc==:

What it leaves open

RFC 9421 does not say where keys come from or what a valid signer is. Web Bot Auth fills that in for bots: it requires the web-bot-auth tag, covers the Signature-Agent header, and points to a published key directory.

How it is used for bots

Signature-Agent header Added by Web Bot Auth. Points the verifier at the signer's key directory. Signed agent A bot or AI agent that signs its requests this way. Web Bot Auth The IETF effort that turns RFC 9421 into an identity check for automated traffic.

Quick answers

Is RFC 9421 only for bots?

No. It is a general-purpose way to sign HTTP messages. Web Bot Auth is one profile of it for automated clients.

Does it survive proxies and CDNs?

That is a design goal. It signs specific components rather than raw bytes, so a signature can still verify after changes HTTP allows intermediaries to make.

Does it encrypt the request?

No. It proves who signed the covered parts and that they were not changed. TLS still does the encryption.

Sources