RFC 9421 HTTP Message Signatures and RFC 9530 Digest Fields: how it relates to agent payment protocols

Steward: IETF HTTP working group (HTTPBIS); RFC 9421 by A. Backman and J. Richer (editors) with M. Sporny; RFC 9530 by R. Polli and L. Pardue
Status: Published RFCs (Proposed Standard)
Latest version: RFC 9421 and RFC 9530 (both published 2024-02-14) (2024-02-14)
Primary source: RFC 9421: HTTP Message Signatures (external link)

What they are

defines how a sender signs selected components of an HTTP message and how a receiver checks the result. The signature travels in two fields, Signature-Input (what was covered and with which parameters) and Signature (the value), and a receiver can ask for one with Accept-Signature. can be ordinary header fields or derived components such as @method, @authority, @path, @query and @target-uri. Signature parameters include created, expires, nonce, alg, keyid and tag, and IANA registries list the algorithms, among them ed25519, ecdsa-p256-sha256 and rsa-pss-sha512. ^{Source [1]}

defines Content-Digest (a digest of the message content) and Repr-Digest (a digest of the representation), plus Want-Content-Digest and Want-Repr-Digest to ask for them. Only sha-256 and sha-512 are active hash algorithms; older ones such as md5 and sha are deprecated. It obsoletes RFC 3230. ^{Source [2]} The two fit together: RFC 9421 does not sign the body directly, so a signer covers a Content-Digest field when the body must be protected, which is exactly what the IETF draft asks agents to do. ^{Source [1, 3]}

Status

Both are Proposed Standards from the IETF HTTP working group, and both info pages give February 2024 as the publication date; the datatracker records the publication day as 2024-02-14 for each. ^{Source [4, 5, 6]} lists A. Backman and J. Richer as editors with M. Sporny; is by R. Polli and L. Pardue. ^{Source [4, 5]}

How they relate to the eight

is the shared base of the agent-recognition layer. Visa TAP signs requests with Signature-Input and Signature over @authority and @path, with created, expires, keyid, alg, nonce and tag, and does not use . ^{Source [7]} Mastercard Agent Pay signs with RFC 9421, with Ed25519 in its examples. ^{Source [8, 9]} UCP uses both RFCs: RFC 9421 for requests, responses and webhooks, and a sha-256 Content-Digest over the raw body bytes. ^{Source [10]}

MPP uses RFC 9530 in its core specification, where a content digest binds the to the request body for POST, PUT and PATCH; RFC 9421 appears only as optional attestation in the mppx SDK. ^{Source [11, 12]} In x402, RFC 9421 shows up only in Cloudflare’s cloudflare:402 . ^{Source [13]} The ACP specification does not use RFC 9421. ^{Source [14]} No use was found in AP2 or ERC-8004.

Status history

2024-02-14: and published. ^{Source [6]}

Relations at a glance

How RFC 9421 HTTP Message Signatures and RFC 9530 Digest Fields relates to each protocol
Protocol	Relation	Note
Visa Trusted Agent Protocol	Complements	TAP signs agent requests with RFC 9421 (Signature-Input and Signature over @authority and @path, with a nonce and a tag); it does not use RFC 9530.
UCP	Complements	UCP signs requests, responses and webhooks with RFC 9421 and binds the body with a sha-256 Content-Digest from RFC 9530.
Mastercard Agent Pay	Complements	Agent Pay agents sign requests with RFC 9421; no RFC 9530 use was found.
Stripe MPP (Machine Payments Protocol)	Complements	The MPP core specification uses an RFC 9530 content digest to bind a challenge to the request body; RFC 9421 appears only as an optional mppx SDK feature.
x402	Compatible with	RFC 9421 appears only in the Cloudflare cloudflare:402 scheme and a signatures extension, not in the core schemes.

Back to the orbit

Sources

RFC 9421: HTTP Message Signatures (external link)IETF (RFC Editor). Standard, primary source. Published 2024-02-01. Accessed 2026-10-11.
RFC 9530: Digest Fields (external link)IETF (RFC Editor). Standard, primary source. Published 2024-02-01. Accessed 2026-10-11.
draft-ietf-webbotauth-httpsig-protocol-00: HTTP Message Signatures for automated traffic (external link)IETF Web Bot Auth working group. Standard, primary source. Published 2026-09-01. Accessed 2026-10-11.
RFC 9421 info page: HTTP Message Signatures (external link)RFC Editor. Standard, primary source. Published 2024-02-14. Accessed 2026-10-11.
RFC 9530 info page: Digest Fields (external link)RFC Editor. Standard, primary source. Published 2024-02-14. Accessed 2026-10-11.
Datatracker API: RFC published events for RFC 9421 and RFC 9530 (external link)IETF Datatracker. Dataset, primary source. Accessed 2026-10-11.
Trusted Agent Protocol merchant specifications (external link)Visa. Specification, primary source. Accessed 2026-10-11.
RFC 9421: HTTP Message Signatures (external link)IETF (RFC Editor). Standard, primary source. Published 2024-02-01. Accessed 2026-10-11.
Level 1 Agentic Commerce: Enable Agent Support with Minimal Changes (external link)Mastercard Developers (Merchant Cloud tutorials). Documentation, primary source. Accessed 2026-10-11.
UCP Message Signatures (v2026-08-25) (external link)UCP Authors. Specification, primary source. Published 2026-08-25. Accessed 2026-10-11.
The "Payment" HTTP Authentication Scheme (draft-httpauth-payment-01, repository source) (external link)Tempo Labs and Stripe (B. Ryan, J. Moxey, T. Meagher, J. Weinstein, S. Kaliski). Specification, primary source. Published 2026-09-09. Accessed 2026-10-11.
Expanding identity support in mppx (MPP blog) (external link)Tempo Labs (mpp.dev). Announcement, primary source. Published 2026-08-12. Accessed 2026-10-11.
Scheme: batch-settlement on cloudflare:402 (external link)x402 Foundation. Specification, primary source. Published 2026-04-15. Accessed 2026-10-10.
ACP rfcs directory (status lines of all 15 RFCs) (external link)Agentic Commerce Protocol project. Specification, primary source. Accessed 2026-10-11.