a signed hello
adafruit labs / reviewed 2026-10-22

try it: https://adafruit.ai/webbotauth
public resource index: https://adafruit.ai/llms.txt

what this is

an isolated educational experiment in how an automated reader can introduce
itself with an HTTP message signature. people and ints need ways to make
truthful introductions. a checked signature can show that a key holder
signed the covered request, within a stated time window. replay remains
possible; this alone does not prove the current sender holds the key.

it cannot, by itself, tell us who owns the key, whether to trust its owner,
or what the sender should be allowed to do. identity and permission require
their own checks. the purpose here is to make those separate steps visible.

what the buttons do

your browser makes one fixed GET request to:
https://adafruit.ai/webbotauth/card

the fresh test signs a 60-second window. the changed-signature test flips
one signature byte. the expired test signs a window that has already ended.
the unsigned test makes the same public request without an introduction.

the server checks only a publicly known Ed25519 test key from RFC 9421,
appendix B.1.4. its private part is published in that RFC: anyone can sign
with it. the claimed agent name, https://webbotauth.example, is reserved
for examples. this is not an Adafruit agent identity or a verified operator.

the signature covers the method, authority, complete target URI, and the
named entry in Signature-Agent. accepted introductions can be replayed
during their short window. this experiment keeps no replay cache and makes
no single-use promise. changed or expired signatures are rejected as signed
introductions. invalid signatures return HTTP 400, not an authentication
challenge. no test grants private access or authority to change anything.

the same card is public for unsigned readers:
https://adafruit.ai/puppetshow/playground/b-is-for-battery

why we are trying it

user-agent strings are useful descriptions, but anyone can claim a name.
signatures give software something more specific to check. this study lets
people see a valid signature, a changed signature, an expired signature,
and an unsigned request side by side, with the same public reading access.

it tests a narrow request-signature profile from the Web Bot Auth HTTP
Message Signatures protocol draft, version 00. that draft is work in
progress, not an RFC. HTTP Message Signatures itself is RFC 9421. there is
no key-directory discovery, domain ownership verification, real operator
authentication, production bot authorization, or Cloudflare verified-bot
status here. older Cloudflare edge examples use a different header format.

our public access policy

people and automated readers may read, watch, crawl, and index our public
pages and films. signatures are not required. use a descriptive, truthful
user-agent. follow the credits, licenses, and terms attached to each work.
public reading and indexing are not blanket permission to train on every
resource, remove attribution, or act for someone else. this experiment
adds no license or training permission.

private workspaces retain their existing approved-access requirements.
this public test key, the resource index, and robots.txt grant no private
access or action authority. a 403 is an access denial; repeated retries do
not grant access. there is no public registration or public write API.

privacy and practical limits

the browser sends an introduction test only after a click, without cookies or credentials.
it signs only the fixed public request. no arbitrary URL, message body, or
private account data is accepted. introductions are not saved by this
application. the signature test uses no visitor analytics, application
cookies, browser storage, model calls, or remote runtime scripts.
hosting and security providers still process requests to deliver and protect
the site. this is not a claim of zero provider processing or retention.

current browser Ed25519 support is needed for signing. unsigned reading and
the explanation remain available without it. without JavaScript, the film
link and this text still work. results describe this fixed test, not every
agent, bot, browser, request, or service on the site.

primary references

IETF Web Bot Auth working group:
https://datatracker.ietf.org/wg/webbotauth/about/

version 00 protocol draft:
https://www.ietf.org/archive/id/draft-ietf-webbotauth-httpsig-protocol-00.html

HTTP Message Signatures and the public test key:
https://www.rfc-editor.org/rfc/rfc9421.html
https://www.rfc-editor.org/rfc/rfc9421.html#appendix-B.1.4

site security and reporting:
https://adafruit.ai/security