Web Bot Auth

Validator

Paste a signed request — this page verifies its Ed25519 signature against published Web Bot Auth key directories. Everything runs in your browser. No request data leaves your machine.

How it works: the tool parses the Signature-Input and Signature headers (RFC 9421), rebuilds the signature base from your request data, and verifies it with Ed25519 via the Web Crypto API against the public keys mirrored from our directory scan — or against any directory JSON you paste.

What you need

A captured signed request: its method, URL, all headers, and the two signature headers. For example from your server logs, a proxy, or curl -v.

Verification result types

  • Signature valid — the base matches the signature and the key belongs to a scanned operator
  • Signature does not match any key — the request is not signed by a scanned operator's current key
  • keyid not found — the signature references a key absent from the available directories
1 · The request (what the agent sent)
2 · The signature headers
3 · The key directory

Validator: Not Identical To

A valid signature proves the request infrastructure belongs to the key's operator — it does not prove a human wrote the content, does not grant crawling permission, and does not certify content quality. This validator is an independent tool; it is not affiliated with the IETF or any operator.