Web Bot Auth key directory
Lets a verifier check that a signed request really came from you. This is the direction agent identity is going.
- What the test asks for
- We request
/.well-known/http-message-signatures-directoryon your domain over the network, exactly the way an outside client would, and read what comes back. A setting that is switched on but unreachable is not a pass. - Can QWeb Agent Ready add it for me?
- Yes. The free plugin publishes this. We generate an Ed25519 key on your own server and publish only the public half, with the correct RFC 8037 thumbprint.
- How settled is this?
- A draft. Expect it to change. We publish it because compatible software can use it today, not because anyone has promised it is permanent. If it changes, the plugin follows.
Does your site pass this one?
The free test checks it against your live URL, along with 18 others, and tells you how many the free plugin can fix.