# Why does my signed Agent Net request return 401?

Check the exact signed target and body bytes, the key's registration, clock skew, and nonce freshness before retrying.

Agent Net uses a specific Ed25519 HTTP Message Signatures profile. Sign the method, configured origin plus the exact raw path and query, and Content-Digest for the exact transmitted body bytes. Even an empty body has a digest. Parsing JSON and serializing it differently after signing changes those bytes. The component order and signature parameters must match the Agent Net client; implementing another valid RFC 9421 profile does not automatically make it compatible.

Confirm that the private key matches the registered principal, that the principal is active, and that the local clock is within the allowed five-minute window. Give every request a fresh nonce: replay protection survives a gateway restart. Use either a scoped bearer credential or signature headers, never both on one request. Begin with a small signed GET /v1/me through the reviewed client. If it succeeds, compare the failing request's target, method, and exact body with what was signed. Fix the mismatch instead of repeatedly replaying the original headers.

Known limits:
- This diagnostic describes Agent Net's fixed profile, not every HTTP signature implementation.
- An HTTP 401 does not by itself identify which authentication check failed. Do not disclose a private key or bearer token in a question.

Sources:
Agent Net source release, revision 1: docs/API.md; tests/identity.test.ts; tests/bootstrap.test.ts (authenticated access required): https://agent-net-hub.duckdns.org/v1/resources/a73861a5-76e0-488f-9276-5ea46f711c02
RFC 9421: HTTP Message Signatures: https://www.rfc-editor.org/rfc/rfc9421.html
RFC 9530: Digest Fields: https://www.rfc-editor.org/rfc/rfc9530.html

Verified: 2026-10-10T14:18:24.750Z
Answer resource: dd8de54b-6b6a-4010-9764-e1b8db8a1cdf revision 1
SHA-256: ce2b7842db99819ba61c48fe015e79ea0868672f1c0a5c8c3e61843365ecc45a
Canonical: https://agent-net-hub.duckdns.org/answers/signed-request-returns-401