Web Bot Auth HTTP Message Signatures (WebBotAuth) vs Anonymous Bot Authentication (ABA)
The map lists them as complementary: sites and agents commonly implement both.
| Web Bot Auth HTTP Message Signatures WebBotAuth | Anonymous Bot Authentication ABA | |
|---|---|---|
| Lifecycle step | 2 Identify: Who is this agent? Who is this site? | 2 Identify: Who is this agent? Who is this site? |
| Answers | Which automated client made this HTTP request, and can the origin verify it cryptographically? | How can a site tell authorised, well-behaved bots from others, and rate-limit them, without learning which bot sent each request? |
| Governed by | IETF webbotauth Working Group (chartered; document adopted as a WG item 2026-09-01) | Individual Internet-Draft, not adopted by a working group; source at github.com/ekr/draft-rescorla-anonymous-webbotauth |
| Status (issuer's words) | Active Internet-Draft, WG Document, Intended Status: Standards Track; expires 5 March 2027 | Active Internet-Draft, Intended Status: Informational; expires 20 January 2027; the draft says it 'has not yet seen significant security analysis' |
| Version | draft-ietf-webbotauth-httpsig-protocol-00, adopted by the webbotauth WG, 2026-09-01 (replaces the individual draft-meunier-webbotauth-httpsig-protocol, last revision -02 of 2026-08-18) (2026-09-01) | draft-rescorla-anonymous-webbotauth-01 (2026-07-19) |
| Form / transport | HTTP header | endpoint |
| Found at | /.well-known/http-message-signatures-directory | None at an origin: a bot registers with a credential Anchor, receives an Endorsement, redeems it with a Moderator (run by or for the site) for an anonymous Credential and presents that Credential; the concrete design uses the MoLE architecture |
| Implementation | multi-implementation — Cloudflare (edge verification, verified-bots program) and independent client/server implementations listed in the draft's own appendix | none found |
| Evidence | 6 verified | 2 verified |
| Primary use case | Prove an agent's identity | Prove an agent's identity |
| Last verified | 2026-10-23 (current) | 2026-10-23 (current) |
| Specification | https://datatracker.ietf.org/doc/draft-ietf-webbotauth-httpsig-protocol/ | https://datatracker.ietf.org/doc/draft-rescorla-anonymous-webbotauth/ |
When to use which
- Choose Web Bot Auth HTTP Message Signatures when your question is “Which automated client made this HTTP request, and can the origin verify it cryptographically?” and you accept its maturity: status "Active Internet-Draft, WG Document, Intended Status: Standards Track; expires 5 March 2027", implementation multi-implementation (Cloudflare (edge verification, verified-bots program) and independent client/server implementations listed in the draft's own appendix).
- Choose Anonymous Bot Authentication when your question is “How can a site tell authorised, well-behaved bots from others, and rate-limit them, without learning which bot sent each request?” and you accept its maturity: status "Active Internet-Draft, Intended Status: Informational; expires 20 January 2027; the draft says it 'has not yet seen significant security analysis'", implementation none found.
Read the full articles
- Web Bot Auth HTTP Message Signatures: Which automated client made this HTTP request, and can the origin verify it cryptographically?
- Anonymous Bot Authentication: How can a site tell authorised, well-behaved bots from others, and rate-limit them, without learning which bot sent each request?