adafruit labs plain text / what and why

introductions.

a signed hello.

people and ints need good ways to introduce themselves. here, an automated reader signs a request for one public film card. the server checks it, then explains what it means.

a checked signature shows that a key holder signed the request. deciding who that key belongs to, and what they may do, takes more.

try an introduction.

public reading only

  1. introduce

    send a signed hello

  2. check signature

    match the test key

  3. check time

    accept a short window

  4. choose access

    keep it public and read-only

this uses a publicly known RFC test key and the reserved name webbotauth.example. anyone can make this signature. it identifies no real operator, including Adafruit.

the test controls need JavaScript. the explanation and film below work without it.

the server’s answer

ready when you are.

choose a test. no introduction has been sent yet.

the same public card for everyoneb is for batterya circuit playground film, with captions and a transcript.

unsigned readers receive the same card. an expired or changed signature is rejected as a signed introduction, without making public knowledge private.

what we are learning.

a truthful introduction can be more useful than a user-agent string alone. a request can carry a signature that software can check, with a stated time window.

identity and permission stay separate. this experiment opens no private workspace, changes nothing, and gives no authority to act for a person. our public films stay open.

under the hood headers, limits, and the draft

one fixed request

GET https://adafruit.ai/webbotauth/card. your browser signs this exact request locally, then sends it without cookies or credentials. no other URL or request body can be submitted here.

a draft, with a deliberate test boundary

this tests a narrow request-signature profile from the Web Bot Auth protocol draft, version 00, using HTTP Message Signatures, RFC 9421. the draft is work in progress, not an RFC. the older Cloudflare edge example uses a different header format; this page does not claim Cloudflare verified-bot status.

the server checks only the RFC’s publicly known Ed25519 test key. it does not discover a domain’s keys or verify ownership of webbotauth.example. a fresh signature lasts 60 seconds and can be replayed during that window. there is no write permission to protect in this experiment.

the signature covers the method, authority, complete target URI, and the named entry in Signature-Agent. changing those signed values invalidates it. the changed-signature test flips one signature byte; the expired test signs an already elapsed window.

last request headers

no request sent.

last response

no response yet.

the signature test uses no visitor analytics, application cookies, or browser storage, and saves no introductions. hosting and security providers still process requests to deliver and protect the site.