# Step 12 — signed bots (RFC 9421)

Publish /.well-known/http-message-signatures-directory with your Ed25519 public JWK so counterparties can verify your outbound agent’s signed requests — and so you can verify theirs. This is the difference between an allowlist of user-agent strings and real identity.

Canonical: https://robauto.ai/learn/advanced-agentic-commerce/14

_Advanced Agentic Commerce: Ship the Full Agent Surface — lesson 14 of 20 (DEFINITION)_

Publish /.well-known/http-message-signatures-directory with your Ed25519 public JWK so counterparties can verify your outbound agent’s signed requests — and so you can verify theirs. This is the difference between an allowlist of user-agent strings and real identity.

Source: [IETF RFC 9421](https://www.rfc-editor.org/rfc/rfc9421.html?utm_source=robauto)

[Previous lesson](/learn/advanced-agentic-commerce/13) · [Next lesson](/learn/advanced-agentic-commerce/15) · [Course overview](/learn/advanced-agentic-commerce) · [All courses](/learn)

---

(c) 2026 Robauto, Inc. — support@robauto.ai
Machine surfaces: https://robauto.ai/llms.txt · https://robauto.ai/llms-full.txt · https://robauto.ai/.well-known/api-catalog