wbauth

Web bot authentication host. Serves an HTTP Message Signatures directory endpoint using Ed25519 keys, following the HTTP Message Signatures standard.

A demo instance of the service is accessible at https://test.wbauth.lightpanda.io/.well-known/http-message-signatures-directory

Usage

WBA_PRIVATE_KEY="$(cat key.pem)" wbauth [options]

Environment variables

| Variable | Description | Default | |---|---|---| | WBA_PRIVATE_KEY | Ed25519 private key in PEM format (required) | — | | WBA_API_ADDRESS | HTTP server listen address | 127.0.0.1:8081 |

Options

-api-addr — HTTP server listen address (overrides WBA_API_ADDRESS)
-verbose — Enable debug log level

Endpoints

`GET /ack`

Health check endpoint. Returns an empty 200 OK response.

$ curl http://127.0.0.1:8081/ack -i
HTTP/1.1 200 OK
Date: Mon, 17 Mar 2026 12:00:00 GMT
Content-Length: 0

`GET /.well-known/http-message-signatures-directory`

Returns the Ed25519 public key in JWK format. The response is signed according to RFC 9421 — HTTP Message Signatures.

Content-Type: application/http-message-signatures-directory+json
Signature tag: http-message-signatures-directory
Signature expiration: 60 seconds

$ curl http://127.0.0.1:8081/.well-known/http-message-signatures-directory -i
HTTP/1.1 200 OK
Content-Type: application/http-message-signatures-directory+json
Signature: http-message-signatures-directory=:BASE64_SIGNATURE:
Signature-Input: http-message-signatures-directory=("@authority");created=...;expires=...;keyid="..."

{
  "keys": [
    {
      "kty": "OKP",
      "crv": "Ed25519",
      "x": "BASE64_PUBLIC_KEY"
    }
  ]
}

License

Apache 2.0 — See LICENSE.

Wbauth

Install / Use

README