RFC 9421 Signatures in the Wild

Like many others building software that communicates with servers on the Fediverse, I followed the How to make friends and verify requests tutorial that demonstrated how a server can easily verify a digital signature to accept a message from another server. It was good enough to get started! Meanwhile, an IETF working group was producing a standard for HTTP Message Signatures that became RFC 9421 and was published in February, 2024. In August, 2026, Mastodon 4.7 was released which began sending signatures with this new IETF standard: We now emit RFC 9421 signatures when requests fail using the previous draft specification, allowing compatibility between Mastodon 4.7 and servers that only implement the final RFC 9421 specification, while retaining compatibility with servers that only implement the previous draft specification So, in September, I updated Irwin to process incoming RFC 9421 signatures. However, because Irwin supports both legacy and standard signatures, the Mastodon 4.7…