{
 "url": "https://agenticweb.wiki/compare/webbotauth-vs-jafar/",
 "title": "WebBotAuth vs JAFAR: differences & adoption",
 "description": "Web Bot Auth HTTP Message Signatures vs JAFAR: A JSON-Based Format for Publishing IP Ranges of Automated HTTP Clients: The map lists them as…",
 "markdown_url": "https://agenticweb.wiki/compare/webbotauth-vs-jafar/index.md",
 "markdown": "# Web Bot Auth HTTP Message Signatures (WebBotAuth) vs JAFAR: A JSON-Based Format for Publishing IP Ranges of Automated HTTP Clients\n\nThe map lists them as complementary: sites and agents commonly implement both.\n\n[2 Identify](/category/identify/) [Web Bot Auth HTTP Message Signatures](/protocols/webbotauth/) · [2 Identify](/category/identify/) [JAFAR: A JSON-Based Format for Publishing IP Ranges of Automated HTTP Clients](/protocols/jafar/)\n\n|  | [Web Bot Auth HTTP Message Signatures](/protocols/webbotauth/) WebBotAuth | [JAFAR: A JSON-Based Format for Publishing IP Ranges of Automated HTTP Clients](/protocols/jafar/) JAFAR |\n| --- | --- | --- |\n| Lifecycle step | 2 Identify: Who is this agent? Who is this site? | 2 Identify: Who is this agent? Who is this site? |\n| Answers | Which automated client made this HTTP request, and can the origin verify it cryptographically? | How can a crawler or bot operator publish the IP ranges its automated clients use, in one machine-readable format that sites can check traffic against? |\n| Governed by | IETF webbotauth Working Group (chartered; document adopted as a WG item 2026-09-01) | Individual Internet-Draft, not adopted by a working group; despite 'webbotauth' in its name, discussion takes place on the AI Preferences (aipref) WG list ai-control@ietf.org; source at github.com/garyillyes/jafar |\n| Status (issuer's words) | Active Internet-Draft, WG Document, Intended Status: Standards Track; expires 5 March 2027 | Active Internet-Draft (draft-illyes-webbotauth-jafar-01), Intended Status: Informational; expires 2027-04-25 |\n| Version | draft-ietf-webbotauth-httpsig-protocol-00, adopted by the webbotauth WG, 2026-09-01 (replaces the individual draft-meunier-webbotauth-httpsig-protocol, last revision -02 of 2026-08-18) (2026-09-01) | draft-illyes-webbotauth-jafar-01 (2026-10-22) |\n| Form / transport | HTTP header | document format |\n| Found at | /.well-known/http-message-signatures-directory | None defined: the draft specifies only the JSON file's syntax and semantics (media type application/jafar+json), not where it is published or how it is retrieved |\n| Implementation | multi-implementation — Cloudflare (edge verification, verified-bots program) and independent client/server implementations listed in the draft's own appendix | none found |\n| Evidence | 6 verified | 3 verified |\n| Primary use case | Prove an agent's identity | Attribute and measure agent traffic |\n| Last verified | 2026-10-23 (current) | 2026-10-23 (current) |\n| Specification | [https://datatracker.ietf.org/doc/draft-ietf-webbotauth-httpsig-protocol/](https://datatracker.ietf.org/doc/draft-ietf-webbotauth-httpsig-protocol/) | [https://datatracker.ietf.org/doc/html/draft-illyes-webbotauth-jafar-01](https://datatracker.ietf.org/doc/html/draft-illyes-webbotauth-jafar-01) |\n\n## When to use which\n\n- Choose Web Bot Auth HTTP Message Signatures when your question is “Which automated client made this HTTP request, and can the origin verify it cryptographically?” and you accept its maturity: status \"Active Internet-Draft, WG Document, Intended Status: Standards Track; expires 5 March 2027\", implementation multi-implementation (Cloudflare (edge verification, verified-bots program) and independent client/server implementations listed in the draft's own appendix).\n- Choose JAFAR: A JSON-Based Format for Publishing IP Ranges of Automated HTTP Clients when your question is “How can a crawler or bot operator publish the IP ranges its automated clients use, in one machine-readable format that sites can check traffic against?” and you accept its maturity: status \"Active Internet-Draft (draft-illyes-webbotauth-jafar-01), Intended Status: Informational; expires 2027-04-25\", implementation none found.\n\nGuidance is derived from the two records (question, status, implementation, prerequisites, pairings), not from opinion. Each record's page carries its numbered references.\n\n## Read the full articles\n\n- [Web Bot Auth HTTP Message Signatures](/protocols/webbotauth/): Which automated client made this HTTP request, and can the origin verify it cryptographically?\n- [JAFAR: A JSON-Based Format for Publishing IP Ranges of Automated HTTP Clients](/protocols/jafar/): How can a crawler or bot operator publish the IP ranges its automated clients use, in one machine-readable format that sites can check traffic against?\n\nAsk the MCP server to compare any two: the compare-protocols prompt, or get on both ids. [Connect](/connect/).\n\n[webbotauth.json](/data/protocols/webbotauth.json) · [jafar.json](/data/protocols/jafar.json) · [Markdown](/compare/webbotauth-vs-jafar/index.md)\n"
}