sylius-web-bot-auth — verifiable from outside, with no claim inward.
The bundle publishes the key directory at /.well-known/http-message-signatures-directory. It covers only the outbound half of the protocol: others can use it to verify requests from this shop. It does not verify inbound requests.
A kid that is configured can drift away from the key.
Web Bot Auth has two halves: signing requests and verifying signatures. This bundle does only the first — it provides the directory with which others can verify this shop's signatures. That is not a gap but a boundary: verifying inbound requests decides who gets into the shop, and that decision does not belong in a bundle you install on the side.
The kid is the RFC 7638 thumbprint and is derived from the key on every render, not read from the configuration. A configured value would be a second truth about the same key: after a rotation it points to something that no longer exists, and every verification fails even though nothing about the directory looks wrong. Derived, it cannot drift.
The seed must be its own secret, never APP_SECRET. Anyone who knows the seed can sign requests in this shop's name — that is a different order of magnitude from what APP_SECRET is otherwise used for, and in a grown setup APP_SECRET tends to get passed around in too many places.
Source code & documentation
Composer package
MIT · Sylius 2.0+ · PHP 8.2+
composer require koh/sylius-web-bot-auth
Built, tested and released under MIT. Public distribution via Packagist is being prepared (coming soon).
Part of the family
MIT
This package is part of koh/sylius-agent-ready — seventeen bundles that make a Sylius shop usable for AI agents. Each one works on its own.