AlgoVoi

AlgoVoi RFC 9421 Testbed

Run a real signed agent message through the live verifier, then break it and watch it get rejected. Want to watch the same signed message travel over sound? See the Secured Gibberlink demo.

What this proves, honestly

When one agent tells another "agent-b authorized a 12.50 USDC payment," the receiver needs to answer two separate questions: did agent-b really say this, and was it changed in transit. An RFC 9421 HTTP Message Signature answers both: the sender signs the method, authority, path, and a digest of the body with an Ed25519 key, so any tampering breaks the signature and anyone with the sender's public key can check it offline.

Transport-agnostic. The signature travels with the message, so this works over the plain HTTP agents already speak, and it survives being carried over other channels too (we have carried the same signed envelope over sound). The channel does not have to be trusted for the message to be provable.

The verifier is the live thing here. POST https://verify.algovoi.co.uk/rfc9421 is a stateless, deployed service. This page sends it a signed request and shows you exactly what it returns.

What the anchor does and does not do. The public key in the envelope is only as trustworthy as your knowledge of whose key it is. Binding a key to a named root (a DID or a domain) relocates trust to that named root; it does not remove trust. This testbed verifies the signature math; deciding that a given key really belongs to "agent-b" is a separate, out-of-band step.

No fabricated adoption numbers here. The only claims on this page are what the live endpoint actually computes when you press the button.

Try it against the live endpoint

Load the genuine prefilled example (generated by make_example.py with a throwaway key), or paste your own signed request, then verify it live. Header keys are sent lowercase, as the service requires.

Call it yourself copy-paste

An agent or developer can sign their own message and verify it live in one run. The Python path uses the published algovoi-rfc9421-signer package.

Python

# pip install algovoi-rfc9421-signer
import base64, json, time, urllib.request
from nacl.signing import SigningKey
from algovoi_rfc9421_signer import sign_request

key = SigningKey.generate()
seed_hex = key.encode().hex()
pk_hex   = key.verify_key.encode().hex()

body = json.dumps({"intent": "authorize_payment", "amount": "12.50",
                   "currency": "USDC"}, separators=(",", ":")).encode()

s = sign_request(method="POST", authority="agent-b.local", path="/a2a/message",
                 body=body, private_key=seed_hex,
                 keyid=f"did:key:z-demo-{pk_hex[:16]}", created=int(time.time()))

envelope = {
    "method": "POST", "authority": "agent-b.local", "path": "/a2a/message",
    "scheme": "https",
    "headers": {  # lowercase keys required
        "content-digest": s.content_digest,
        "signature-input": s.signature_input,
        "signature": s.signature,
    },
    "body_b64": base64.b64encode(body).decode(),
    "public_key_hex": pk_hex,
    "require_content_digest": True, "mode": "rfc9421",
}

req = urllib.request.Request(
    "https://verify.algovoi.co.uk/rfc9421",          # real path, not /verify/rfc9421
    data=json.dumps(envelope).encode(), method="POST",
    headers={"Content-Type": "application/json",
             "User-Agent": "Mozilla/5.0"})            # a normal UA avoids the Cloudflare 403
print(json.load(urllib.request.urlopen(req)))         # -> {"valid": true, ...}

curl (verify an existing envelope)

curl -s https://verify.algovoi.co.uk/rfc9421 \
  -H "Content-Type: application/json" \
  -H "User-Agent: Mozilla/5.0" \
  --data @example.json

The full runnable script is example_client.py in this testbed folder.

Notes for running this page