# Web Bot Auth HTTP Message Signatures (WebBotAuth) vs Anonymous Bot Authentication (ABA)

The map lists them as complementary: sites and agents commonly implement both.

[2 Identify](/category/identify/) [Web Bot Auth HTTP Message Signatures](/protocols/webbotauth/) · [2 Identify](/category/identify/) [Anonymous Bot Authentication](/protocols/anonymous-bot-auth/)

|  | [Web Bot Auth HTTP Message Signatures](/protocols/webbotauth/) WebBotAuth | [Anonymous Bot Authentication](/protocols/anonymous-bot-auth/) ABA |
| --- | --- | --- |
| Lifecycle step | 2 Identify: Who is this agent? Who is this site? | 2 Identify: Who is this agent? Who is this site? |
| Answers | Which automated client made this HTTP request, and can the origin verify it cryptographically? | How can a site tell authorised, well-behaved bots from others, and rate-limit them, without learning which bot sent each request? |
| Governed by | IETF webbotauth Working Group (chartered; document adopted as a WG item 2026-09-01) | Individual Internet-Draft, not adopted by a working group; source at github.com/ekr/draft-rescorla-anonymous-webbotauth |
| Status (issuer's words) | Active Internet-Draft, WG Document, Intended Status: Standards Track; expires 5 March 2027 | Active Internet-Draft, Intended Status: Informational; expires 20 January 2027; the draft says it 'has not yet seen significant security analysis' |
| Version | draft-ietf-webbotauth-httpsig-protocol-00, adopted by the webbotauth WG, 2026-09-01 (replaces the individual draft-meunier-webbotauth-httpsig-protocol, last revision -02 of 2026-08-18) (2026-09-01) | draft-rescorla-anonymous-webbotauth-01 (2026-07-19) |
| Form / transport | HTTP header | endpoint |
| Found at | /.well-known/http-message-signatures-directory | None at an origin: a bot registers with a credential Anchor, receives an Endorsement, redeems it with a Moderator (run by or for the site) for an anonymous Credential and presents that Credential; the concrete design uses the MoLE architecture |
| Implementation | multi-implementation — Cloudflare (edge verification, verified-bots program) and independent client/server implementations listed in the draft's own appendix | none found |
| Evidence | 6 verified | 2 verified |
| Primary use case | Prove an agent's identity | Prove an agent's identity |
| Last verified | 2026-10-23 (current) | 2026-10-23 (current) |
| Specification | [https://datatracker.ietf.org/doc/draft-ietf-webbotauth-httpsig-protocol/](https://datatracker.ietf.org/doc/draft-ietf-webbotauth-httpsig-protocol/) | [https://datatracker.ietf.org/doc/draft-rescorla-anonymous-webbotauth/](https://datatracker.ietf.org/doc/draft-rescorla-anonymous-webbotauth/) |

## When to use which

- Choose Web Bot Auth HTTP Message Signatures when your question is “Which automated client made this HTTP request, and can the origin verify it cryptographically?” and you accept its maturity: status "Active Internet-Draft, WG Document, Intended Status: Standards Track; expires 5 March 2027", implementation multi-implementation (Cloudflare (edge verification, verified-bots program) and independent client/server implementations listed in the draft's own appendix).
- Choose Anonymous Bot Authentication when your question is “How can a site tell authorised, well-behaved bots from others, and rate-limit them, without learning which bot sent each request?” and you accept its maturity: status "Active Internet-Draft, Intended Status: Informational; expires 20 January 2027; the draft says it 'has not yet seen significant security analysis'", implementation none found.

Guidance is derived from the two records (question, status, implementation, prerequisites, pairings), not from opinion. Each record's page carries its numbered references.

## Read the full articles

- [Web Bot Auth HTTP Message Signatures](/protocols/webbotauth/): Which automated client made this HTTP request, and can the origin verify it cryptographically?
- [Anonymous Bot Authentication](/protocols/anonymous-bot-auth/): How can a site tell authorised, well-behaved bots from others, and rate-limit them, without learning which bot sent each request?

Ask the MCP server to compare any two: the compare-protocols prompt, or get on both ids. [Connect](/connect/).

[webbotauth.json](/data/protocols/webbotauth.json) · [anonymous-bot-auth.json](/data/protocols/anonymous-bot-auth.json) · [Markdown](/compare/webbotauth-vs-anonymous-bot-auth/index.md)