Is this request really GPTBot?

Verify an IP + user agent

curl -H "X-API-Key: rb_live_…" \
  "https://aibots.kaderagha.com/api/aibots/v1/verify?ip=20.171.207.10&ua=Mozilla/5.0%20(compatible;%20GPTBot/1.4)"

{
  "verdict": "verified",            // verified | fake | unverifiable | not_a_bot | invalid_ip
  "bot": { "slug": "gptbot", "name": "GPTBot", "operator": "OpenAI", "kind": "training" },
  "reason": "IP is in the operator's published ranges",
  "feed_generated": "2026-10-19T01:23:00Z"
}

unverifiable = the operator publishes no IP list (e.g. ByteDance, Meta) or the IP is private. Requests claiming Google-Extended are always fake: it's a robots.txt token, not a crawler. All 22 bots.

Verify a Web Bot Auth signature

curl -X POST -H "X-API-Key: rb_live_…" -H "Content-Type: application/json" \
  https://aibots.kaderagha.com/api/aibots/v1/verify-signature -d '{
    "method": "GET",
    "url": "https://your-site.com/page",
    "headers": {
      "Signature-Agent": "sig1=\"https://chatgpt.com\"",
      "Signature-Input": "sig1=(\"@authority\" \"signature-agent\";key=\"sig1\");created=…;expires=…;keyid=\"…\";tag=\"web-bot-auth\"",
      "Signature": "sig1=:…:"
    }
  }'

{ "status": "valid", "agent": "https://chatgpt.com", "reason": "signature verified" }
// status: valid | invalid | nokey | unsupported | unsigned

Keys of known signing agents (Google-Agent, ChatGPT, Browserbase, You.com) are built in; others are fetched from the agent's key directory. See Web Bot Auth explained.

Copy-paste middleware: Python, Express, PHP — tested against the live API.

Usage

curl -H "X-API-Key: rb_live_…" https://aibots.kaderagha.com/api/aibots/v1/usage
{ "plan": "free", "period": "2026-10", "used": 1234, "quota": 10000 }

OpenAPI spec: /data/v1/openapi.json. Errors: 401 invalid_key, 429 quota_exceeded, 503 unavailable. Keys go in X-API-Key or Authorization: Bearer, never in the URL.