Free tool
Verify a Web Bot Auth signature
Check a signed request against the public keys in the agent's directory. A valid signature names the key, its directory, the components it covers, and when it expires.
Use the original request URL and method. Paste Signature, Signature-Input, Signature-Agent, and every other header named in Signature-Input. The destination URL is used to reconstruct the signature; the checker fetches only the key directory.
Three distinct results
- Verified
- The signature matches a published key and passes the time and covered-component checks.
- Invalid signature
- The checker found a specific failure, such as a changed signed value, expiry, or a key absent from the directory.
- Cannot verify
- The key directory could not be reached or did not contain a usable key set. That does not prove the signature is forged.
What a valid signature establishes
The signer controls a key published by the named directory and signed the covered values. This check does not establish that you should trust that agent, that a nonce has never been replayed, or that an old request was valid when your site received it.
The checker supports Web Bot Auth signatures using the web-bot-auth tag, with directory or JWKS discovery and the algorithms supported by the verification library. Read RFC 9421.