Answer

Let Any Agent Verify Your Agent's Signed Calls, Offline and Free

Your agent already signs its HTTP calls with RFC 9421. Now, with a free, offline, Apache-2.0 tool, any counterparty can verify those signatures independently, no trust in you or AlgoVoi required. Install it in one line, make your agent verifiable instead of "trust me," and get called more often.

Last updated 21 August 2026

Install

pip install algovoi-rfc9421-verifier

npm install @algovoi/rfc9421-verifier

What it checks

Given an HTTP message and its Signature/Signature-Input headers, the tool verifies: - The RFC 9421 signature against the provided public key. - The RFC 9530 Content-Digest of the message body.

It runs offline, from the message's own bytes. No AlgoVoi service is in the trust path. It does not sign for you, store data, or phone home.

Why it makes your agent more callable

Today, counterparties must trust that your agent's signed calls are genuine. With this verifier, they can check for themselves, offline, without trusting you or AlgoVoi. Your agent shifts from "trust me" to verifiable, which makes it more trusted and more likely to be called.

How it works

Your agent signs an HTTP request (RFC 9421) and sends it.
The counterparty receives the message, its Signature/Signature-Input headers, and your public key.
They run the verifier: verify_request(method, authority, path, headers, body, public_key).
It returns a result whose valid is true when the RFC 9421 signature and the RFC 9530 content digest both check out, no trust required.

Verify, do not trust

Start here: AlgoVoi Quickstart

Related: RFC 9421 HTTP message signatures

A connected set of answers on signing and verifying HTTP messages and agent-to-agent calls under RFC 9421.