HTTP Message Signature / Trusted Agent Decoder

Why agent requests are signed

A merchant receiving traffic from an AI shopping agent needs to answer a question that cookies and API keys cannot: which agent is this, and can I hold it to account?RFC 9421 HTTP Message Signatures answer it at the HTTP layer. The agent picks a set of covered components — derived values such as @method, @authority and @path, plus any headers it wants bound, such as content-digest — canonicalises them into a signature base, signs it, and sends two headers: Signature-Input (what was covered and with which parameters) and Signature (the bytes). The verifier rebuilds the same base from the request it actually received and checks the signature with the agent's public key.

The profiles you will meet

• Web Bot Auth (Cloudflare → IETF httpbis draft). Ed25519 keys, the keyid is the JWK SHA-256 thumbprint, the key lives in a JWKS at /.well-known/http-message-signatures-directory on the origin named in the Signature-Agent header, and tag="web-bot-auth" plus a short created/expires window and a nonce make signatures single-use. Cloudflare, AWS WAF, Vercel, Shopify and Akamai verify it at the edge.
• Visa Trusted Agent Protocol (TAP). The same mechanics, bound to the merchant's domain and the operation (browse vs pay), with keys resolved through Visa's Agentic Registry after the agent passes Intelligent Commerce vetting. TAP also defines signed claims that carry consumer identifiers and a card's Payment Account Reference so the merchant can pre-fill checkout. Visa's sample code spells the parameter keyId; the RFC says keyid.
• Mastercard Agent Pay uses Web Bot Auth as its request-authentication foundation, with Agentic Tokens and Verifiable Intent carrying the payment-side proof.

What breaks verification

• A proxy that rewrites the path, host or a covered header — the base no longer matches.
• Header whitespace: values are trimmed and multiple instances joined with a comma and a space before they enter the base; obs-folding is unfolded.
• Clock skew: verifiers reject created in the future or older than their window, and anything past expires.
• Replay: without a nonce (or a very short window) a captured request can be re-sent. Web Bot Auth mandates both.
• Body substitution when content-digest is not covered — sign the digest, then the digest protects the body.

The next layer up is the proof that a human authorised the purchase — AP2 mandates, decodable in the AP2 Mandate Decoder — and the money moves over x402 or card rails. Related credential formats: SD-JWT VC, webhook signatures.