Key Directory
Key Directory: Entity Summary
In Web Bot Auth, a key directory is the public endpoint at /.well-known/http-message-signatures-directory where an agent operator publishes the public keys (in JWK format) used to sign its HTTP requests.
Key Directory: Core Facts
- Location
- /.well-known/http-message-signatures-directory on the operator's domain
- Format
- JSON Web Keys (JWK), Ed25519 OKP key type
- Key rotation
- Entries may carry a not-before (nbf) timestamp; verifiers fetch the current state
- Reachable examples (August 2026)
- you.com; Cloudflare Research example server
Key Directory: Classification Metadata
- Entity Class
- Specification
- Status
- "Defined in the Web Bot Auth architecture draft"
- Last verified
Key Directory: Not Identical To
A key directory is not a certificate authority list and does not issue identity certificates. It is the operator's self-published set of public keys; trust is established by verifying request signatures against these keys and by the operator's public reputation. A directory entry is not a license to crawl.
Key Directory: FAQ
Who can read a key directory?
Anyone. Directories are public by design so that every origin server can verify signatures independently, without a vendor in between.