One of the big pain points for ActivityPub developers is supporting HTTP Signature in their servers. The Fediverse uses an out-dated draft standard, [draft cavage 12](https://datatracker.ietf.org/doc/html/draft-cavage-http-signatures-12). There's a helpful [ActivityPub and HTTP Signatures](https://swicg.github.io/activitypub-http-signature/) report from the SocialCG, but it's still kind of a slog.
Some server software has begun the pivot to the release version using [double-knocking](https://swicg.github.io/activitypub-http-signature/#how-to-upgrade-supported-versions), [capability discovery](https://codeberg.org/fediverse/fep/src/branch/main/fep/844e/fep-844e.md), or something else.
To track support for RFC 9421, I added an [adoption matrix](https://swicg.github.io/activitypub-http-signature/RFC9421) to the ActivityPub HTTP Signature repo. I grabbed all the [software listed on FediDB](https://fedidb.com/software/), and laid out a matrix of whether it accepts RFC 9421 signatures for GET and POST or sends RFC 9421 for GET and POST. I also included a way to find relevant bug-tracker issues.
https://swicg.github.io/activitypub-http-signature/RFC9421
It would be a huge help to get some more eyes and data on this adoption matrix. If you know about a Fediverse server package's support for RFC 9421, including your own, please make a PR against the RFC9421.md file in the [swicg/activitypub-http-signature](https://github.com/swicg/activitypub-http-signature) repo.
Thanks!
evan
npub10c…5yacy
2026-08-16 18:11:05 UTC
Author Public Key
npub10c0ahywnza6y4pytk58fwvmzn64q2lskqcxswreqww7vc96dclgs45yacySeen on
wss://relay.momostr.pinkPublished at
2026-08-16 18:11:05 UTCEvent JSON
{
"id": "43102a0769dc31af2644d716f1b696fc7c39c806a1910c7a4c2140f6d0b91a46",
"pubkey": "7e1fdb91d317744a848bb50e9733629eaa057e16060d070f2073bccc174dc7d1",
"created_at": 1786903865,
"kind": 1,
"tags": [
[
"content-warning",
"\u003cp\u003eOne of the big pain points for ActivityPub developers is supporting HTTP Signature in their servers. The Fediverse uses an out-dated draft standard, \u003ca href=\"https://datatracker.ietf.org/doc/html/draft-cavage-http-signatures-12\" rel=\"nofollow ugc\"\u003edraft cavage 12\u003c/a\u003e. There's a helpful \u003ca href=\"https://swicg.github.io/activitypub-http-signature/\" rel=\"nofollow ugc\"\u003eActivityPub and HTTP Signatures\u003c/a\u003e report from the SocialCG, but it's still kind of a slog.\u003c/p\u003e \u003cp\u003eSome server software has begun the pivot to the release version using \u003ca href=\"https://swicg.github.io/activitypub-http-signature/#how-to-upgrade-supported-versions\" rel=\"nofollow ugc\"\u003edouble-knocking\u003c/a\u003e, \u003ca href=\"https://codeberg.org/fediverse/fep/src/branch/main/fep/844e/fep-844e.md\" rel=\"nofollow ugc\"\u003ecapability discovery\u003c/a\u003e, or something else.\u003c/p\u003e \u003cp\u003eTo track support for RFC 9421, I added an \u003ca href=\"https://swicg.github.io/activitypub-http-signature/RFC9421\" rel=\"nofollow ugc\"\u003eadoption matrix\u003c/a\u003e to the ActivityPub HTTP Signature repo. [...]\u003c/p\u003e"
],
[
"proxy",
"https://activitypub.space/post/2366",
"web"
],
[
"proxy",
"https://activitypub.space/post/2366",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://activitypub.space/post/2366",
"pink.momostr"
],
[
"-"
]
],
"content": "One of the big pain points for ActivityPub developers is supporting HTTP Signature in their servers. The Fediverse uses an out-dated draft standard, [draft cavage 12](https://datatracker.ietf.org/doc/html/draft-cavage-http-signatures-12). There's a helpful [ActivityPub and HTTP Signatures](https://swicg.github.io/activitypub-http-signature/) report from the SocialCG, but it's still kind of a slog.\n\nSome server software has begun the pivot to the release version using [double-knocking](https://swicg.github.io/activitypub-http-signature/#how-to-upgrade-supported-versions), [capability discovery](https://codeberg.org/fediverse/fep/src/branch/main/fep/844e/fep-844e.md), or something else.\n\nTo track support for RFC 9421, I added an [adoption matrix](https://swicg.github.io/activitypub-http-signature/RFC9421) to the ActivityPub HTTP Signature repo. I grabbed all the [software listed on FediDB](https://fedidb.com/software/), and laid out a matrix of whether it accepts RFC 9421 signatures for GET and POST or sends RFC 9421 for GET and POST. I also included a way to find relevant bug-tracker issues.\n\nhttps://swicg.github.io/activitypub-http-signature/RFC9421\n\nIt would be a huge help to get some more eyes and data on this adoption matrix. If you know about a Fediverse server package's support for RFC 9421, including your own, please make a PR against the RFC9421.md file in the [swicg/activitypub-http-signature](https://github.com/swicg/activitypub-http-signature) repo.\n\nThanks!",
"sig": "8961b638d105dc47aca6a7b80e54dd159f34753bb4518af0dff338c913834a78bd6b7427849de072388e15006af29e1ae14c1bbaaf1c6b5d545314af3ccb1e40"
}