# The Calling Card


Web Bot Auth key directory check, signed.

## At a glance

- **Attests:** A signed JSON card — verdict (directory_ready, not_ready, unreachable or refused), every check from the directory battery by name including the proof-of-possession verification, dated, its evidence hash bound into the purchase certificate's attests field — plus a stable card URL serving the record free forever. Instant; one GET at one moment, never monitoring.
- **Input:** url (query parameters; input schema and checkout: https://scvd.store/menu/signature_agent_card?view=compact)
- **Output:** A signed JSON card — verdict (directory_ready, not_ready, unreachable or refused), every check from the directory battery by name including the proof-of-possession verification, dated, its evidence hash bound into the purchase certificate's attests field — plus a stable card URL serving the record free forever. Instant; one GET at one moment, never monitoring. Every artifact carries a cert_id and verifies free at https://scvd.store/api/verify/{cert_id}.
- **Cryptography:** ed25519 signature by this store's key, published at https://scvd.store/.well-known/scvd-signing-key and carried inside every 402
- **Verify:** GET https://scvd.store/api/verify/{cert_id} — free, no account, no rate limit, checkable offline with the published key
- **Price and fulfilment:** $0.99 USDC fixed, one-off; nothing here charges again by itself, ever — there is no mechanism that could; delivered instantly
- **Does not attest:** fitness for your particular task; future protocol compatibility beyond stated interfaces; human-labor turnaround faster than posted SLA

## About this item

You stood up Web Bot Auth: your crawler signs its requests (RFC 9421) and your key directory hangs at /.well-known/http-message-signatures-directory. This is somebody who is not you saying it actually works. Name your origin or directory URL (the url query parameter) and the store fetches the document once and signs the readout: reachable, right media type, well-formed Ed25519 keys, and the proof-of-possession signature checked against the keys you list. The look is free at POST /api/bot-auth/check — what this buys is the artifact: a signed card whose evidence hash is bound into your purchase certificate, served at a stable URL forever, quotable to any origin or directory that wants more than your word. One fetch, one moment. Not an endorsement, not an identity check on who holds the key, and it says nothing about whether your requests are actually signed — it is the card that says your published half is in order.

- **id:** `signature_agent_card`
- **price:** $0.99 fixed, one-off; nothing here charges again by itself, ever — there is no mechanism that could
- **fulfillment:** delivered instantly
- **buy:** `GET https://scvd.store/api/buy/signature_agent_card?url=<url>` (USDC over x402 v2 on Base, Polygon, Arbitrum, World, Solana, Arc (Circle Gateway), or USDC over MPP (evm/charge) on Base for every shelf item, every publication page and the commission desk)
- **required inputs:** `url` — fill the `<url>` slot above before paying. The bare door `GET https://scvd.store/api/buy/signature_agent_card` quotes free and refuses the paid request without it; no money moves.
- **sample:** https://scvd.store/samples/signature-agent-card.json

House rules: give your origin or directory url in the url query parameter: https, default port, on the public internet; a bare origin is checked at /.well-known/http-message-signatures-directory; a full url is fetched as given; one get at one moment, signed; never a monitor; we refuse our own hostname — our directory carrying our own card would be the instrument vouching for itself; the card url is free to read forever.

> $0.99. The checking is free and stays free — what costs money is the version somebody else will believe.