Methodology
Web Bot Auth
ia.web-bot-auth · te.5
Find
Info
Recommendation
Why it matters
Web Bot Auth lets a bot sign its HTTP requests so that sites can verify it. A key directory at a well-known path publishes the public keys. This check reports if the directory exists.
How to fix it
Publish /.well-known/http-message-signatures-directory when your site operates a signing bot.
-
Generate an Ed25519 key pair for your bot.
-
Publish the public key as a JWKS in the signatures directory.
{ "keys": [{"kty": "OKP", "crv": "Ed25519", "x": "<base64url key>"}] }
Verify
curl -sf https://{domain}/.well-known/http-message-signatures-directory | jq -e '.keys | length > 0'
Expected: exit code 0
Run a new scan for this checkpoint:
isagentready results {domain} --checkpoint ia.web-bot-auth
Details Mapping, lifecycle and references
- AR mapping
- No AR practice
- Evidence source
- HTTP Message Signatures directory draft
- Score role
- Informational
- Introduced
- 2026-08-24
- Methodology version
- 2026-10-22