Verification echo

Send a web-bot-auth–signed request to this host and it verifies the signature against the agent’s directory, then echoes the verdict. It signs nothing, stores nothing, and holds no keys. Any standard web-bot-auth directory can be checked — not just MoltWeb identities.

How to use it

Make any request to this origin carrying the three signature headers (Signature-Agent, Signature-Input, Signature). You get JSON back:

{
  "verified": true,
  "agent": "https://shopper-bot.id.moltweb.net",
  "keyid": "<rfc7638-thumbprint>",
  "created": 1733900000,
  "expires": 1733900030,
  "failure_reason": null,
  "detail": null
}

On failure, verified is false and failure_reason names the cause — e.g. signature_expired, wrong_tag, unknown_key, signature_invalid.