---
title: "HTTP Message Signatures (RFC 9421): definition | KYA glossary"
url: https://knowyouragent.ch/en/knowledge/glossary/http-message-signatures
lang: en
updated: 2026-10-12
license: © Innopulse Consulting GmbH
---

# HTTP Message Signatures (RFC 9421)

HTTP Message Signatures are an IETF standard (RFC 9421) that lets senders sign selected parts of an HTTP message so that recipients can verify its origin and integrity.

RFC 9421 was published in February 2024. The sender builds a signature base from the selected components, such as method, path, host and certain headers, and signs it. Two headers carry the result: Signature-Input describes what was signed, and Signature contains the signature.

The standard registers Ed25519, ECDSA and RSA-PSS, among others. Because the signature is bound to specific parts of the request, any change to path or content shows up at once. Web Bot Auth and the Trusted Agent Protocol build on this standard.

## Example

RFC 9421 includes an example in Appendix B.2.6: a POST request to /foo, signed with an Ed25519 test key. Verified with the published key, the signature is valid. Change only the path to /bar, and verification fails.

## How it differs

TLS protects the connection, not the individual message; after transmission nothing remains provable. An HTTP signature stays with the message and can be verified later. Unlike a JWT, it signs the request itself instead of a separate token.

## In practice

- Sign at least method, path, host and a point in time, so a signature cannot serve other requests.
- Set a short expiry in the signature parameters to limit the reuse of intercepted requests.
- Test your implementation with the examples from Appendix B of RFC 9421.

## Role in KYA

KYA rebuilds the signature base following RFC 9421 and verifies Ed25519, ECDSA and RSA-PSS with keys provided by the [verifying party](https://knowyouragent.ch/en/knowledge/glossary/verifying-party). The official example from Appendix B.2.6 is available as an example on the verification page.

Related check: [Cryptographic integrity](https://knowyouragent.ch/en/method/checks) (`cryptographic_integrity`). Are signatures, disclosures, hash chains and manifest unchanged?

[Verify now: open a matching example](https://knowyouragent.ch/en/verify?beispiel=rfc9421-ietf)

## Frequently asked questions

### What is RFC 9421?

The IETF standard for HTTP Message Signatures, published in February 2024. It defines how senders sign parts of an HTTP message and how recipients verify that signature.

### Which algorithms does RFC 9421 provide?

The standard registers Ed25519, ECDSA with P-256 and P-384, RSA-PSS and HMAC, among others. KYA verifies Ed25519, ECDSA and RSA-PSS.

### How do I test an HTTP signature with KYA?

Choose the example “IETF RFC 9421” on the verification page or paste your own request with request line and headers. Provide the public key as a JWKS under “Trust of the verifying party”.

### Can an HTTP signature be reused?

Only if it contains no time and no expiry. That is why parameters such as created and expires belong in every signature, and recipients should decline old signatures.

## Sources

- [RFC 9421: HTTP Message Signatures](https://www.rfc-editor.org/rfc/rfc9421)
- [RFC 9421, Appendix B.2.6](https://www.rfc-editor.org/rfc/rfc9421.html#appendix-B.2.6)

## Related terms

- [Web Bot Auth](https://knowyouragent.ch/en/knowledge/glossary/web-bot-auth)
- [Trusted Agent Protocol](https://knowyouragent.ch/en/knowledge/glossary/trusted-agent-protocol)
- [Trust anchor](https://knowyouragent.ch/en/knowledge/glossary/trust-anchor)
- [Key binding](https://knowyouragent.ch/en/knowledge/glossary/key-binding)

---
Quelle: https://knowyouragent.ch/en/knowledge/glossary/http-message-signatures · KYA – Know Your Agent