---
title: "Web Bot Auth signing-key directory (RFC 9421)"
method: GET
path: "/.well-known/http-message-signatures-directory"
---

# Web Bot Auth signing-key directory (RFC 9421)

`GET /.well-known/http-message-signatures-directory`

## Request

- Base URL: `https://charm.ing`
- URL: `https://charm.ing/.well-known/http-message-signatures-directory`
- Auth: none declared

Returns a JWK Set advertising the Ed25519 public key Charming uses to sign outbound HTTP messages. Single-entry today: `{ keys: [{ kty: "OKP", crv: "Ed25519", kid, x, nbf, exp }] }`. `Content-Type: application/jwk-set+json`, `Cache-Control: public, max-age=600`. Storage v0: key is pinned via env vars or generated ephemerally per boot until `WEB_BOT_AUTH_PUBLIC_JWK`/`WEB_BOT_AUTH_KID`/`WEB_BOT_AUTH_NBF` are set on Railway.

## Response `200`

JWK Set with the active Web Bot Auth signing key(s).

---

[API](https://skmtc.dev/charm/apis/charming-api.md) · [All operations](https://skmtc.dev/charm/apis/charming-api/llms.txt) · [OpenAPI document](https://skmtc.dev/charm/apis/charming-api/revisions/a9d06c419b3a?raw)