What is a Signature Agent Card?

The Signature Agent Card is optional metadata that describes the agent behind a Web Bot Auth deployment. It answers “who is this bot, and how does it behave?”, alongside the keys that prove “is this request really from them?”.

What it carries

It is defined by the Web Bot Auth registry draft and can include:

• Operator identity: client_name, client_uri, logo_uri, and contacts.
• Where the keys live: a jwks_uri (https required) pointing to the JSON Web Key Set, or the keys inline.
• Declared purpose, targeted-content, the operational trigger (fetcher or crawler), and the expected-user-agent string.
• robots.txt declarations: rfc9309-compliance (directives implemented) and rfc9309-product-token (the token the agent matches on).
• Rate behaviour: rate-expectation and rate-control.
• Network footprint: ips_uri (an https URL to a published IP-range list) and known-urls.

At least one parameter must be set for the card to count as a card.

How the checker treats it

Agent Card checks are advisory. A missing or incomplete card lowers the score slightly and raises notes, but it never changes the verdict and never caps the grade. A directory with valid keys is still VALID even with no card at all.

Where it lives

Unlike the JWKS directory, which is always at /.well-known/http-message-signatures-directory, the Signature Agent Card has no fixed well-known location. It is referenced from the site or directory via a Link header or homepage <link> element, or listed in a registry.

Not the same as an A2A or MCP agent card

Many sites publish a /.well-known/agent-card.json. That is usually an A2A (Agent2Agent) or MCP agent card, which describes an agent’s skills and interfaces for agent-to-agent use. It is a different standard with different fields (name, skills, supportedInterfaces) and no cryptographic keys. The checker recognises that shape and will not grade it as a Web Bot Auth card.