Guide · Web Bot Auth

Web Bot Auth explained: AI agents that prove who they are

User agents can be faked, and IP addresses only work for crawlers that publish them. Web Bot Auth is an IETF draft that lets a bot or AI agent sign each request with a private key. A website checks the signature against the agent's published public key, and knows the request really came from that agent.

Agents that sign today

These operators publish a Web Bot Auth key directory. We fetch each one every night.

Agent	Signature-Agent	Keys
Google-Agent Google	agent.bot.goog	5 Ed25519 2026-10-21
ChatGPT OpenAI	chatgpt.com	1 Ed25519 2026-10-21
Browserbase Browserbase	browserbase.com	2 Ed25519 2026-10-21
You.com You.com	you.com	1 Ed25519 2026-10-21

Google says its implementation is experimental: a subset of requests from the Google-Agent user agent are signed and authenticated as https://agent.bot.goog, and sites should keep using IP and user-agent checks as well (Google's docs). Signing doesn't mean every request from an agent is signed.

How it works

The agent publishes its public keys as a JWKS at https://<agent>/.well-known/http-message-signatures-directory.
Each request carries three headers: Signature-Agent (where the keys live), Signature-Input (what was signed: at least @authority and the Signature-Agent member, plus created, expires, keyid and tag="web-bot-auth") and Signature.
The website rebuilds the signed text (the "signature base", RFC 9421), finds the key whose JWK thumbprint equals keyid, and verifies the signature.

GET /page HTTP/1.1
Host: example.com
Signature-Agent: sig1="https://agent.example"
Signature-Input: sig1=("@authority" "signature-agent";key="sig1");created=1735689600;expires=1735693200;keyid="…";tag="web-bot-auth"
Signature: sig1=:…base64…:

Verify signed agents on your site

WordPress: the Verified AI Bot Analytics plugin verifies Web Bot Auth signatures (Ed25519) and lists signed agents next to IP-verified bots (version 0.2, rolling out after the wordpress.org review).
Cloudflare: signed agents that Cloudflare has approved show up as verified bots; see our Cloudflare guide.
Testing a signer: paste a request into the Web Bot Auth validator to see every check and the exact signature base. It already knows the keys of the agents above.

Machine-readable

The current keys of all agents above are in our public feed under agents: /data/v1/ranges.json, next to the official IP ranges of 22 AI crawlers.

Spec: draft-ietf-webbotauth-httpsig-protocol (IETF working-group draft; details can change).