{
 "url": "https://agenticweb.wiki/compare/webbotauth-vs-tap/",
 "title": "WebBotAuth vs TAP: differences & adoption",
 "description": "Web Bot Auth HTTP Message Signatures vs Visa Trusted Agent Protocol: The map lists them as complementary: sites and agents commonly implement both.…",
 "markdown_url": "https://agenticweb.wiki/compare/webbotauth-vs-tap/index.md",
 "markdown": "# Web Bot Auth HTTP Message Signatures (WebBotAuth) vs Visa Trusted Agent Protocol (TAP)\n\nThe map lists them as complementary: sites and agents commonly implement both.\n\n[2 Identify](/category/identify/) [Web Bot Auth HTTP Message Signatures](/protocols/webbotauth/) · [2 Identify](/category/identify/) [Visa Trusted Agent Protocol](/protocols/tap/)\n\n|  | [Web Bot Auth HTTP Message Signatures](/protocols/webbotauth/) WebBotAuth | [Visa Trusted Agent Protocol](/protocols/tap/) TAP |\n| --- | --- | --- |\n| Lifecycle step | 2 Identify: Who is this agent? Who is this site? | 2 Identify: Who is this agent? Who is this site? |\n| Answers | Which automated client made this HTTP request, and can the origin verify it cryptographically? | How does a merchant recognize that an approved commerce agent, rather than a crawler or fraudulent bot, is interacting with its site or API? |\n| Governed by | IETF webbotauth Working Group (chartered; document adopted as a WG item 2026-09-01) | Visa (single-vendor specification, published for merchant/developer adoption) |\n| Status (issuer's words) | Active Internet-Draft, WG Document, Intended Status: Standards Track; expires 5 March 2027 | Active vendor-led merchant specification |\n| Version | draft-ietf-webbotauth-httpsig-protocol-00, adopted by the webbotauth WG, 2026-09-01 (replaces the individual draft-meunier-webbotauth-httpsig-protocol, last revision -02 of 2026-08-18) (2026-09-01) | Current merchant specification, 2026, published on Visa Developer |\n| Form / transport | HTTP header | HTTP header |\n| Found at | /.well-known/http-message-signatures-directory | /keys |\n| Implementation | multi-implementation — Cloudflare (edge verification, verified-bots program) and independent client/server implementations listed in the draft's own appendix | prototype — Visa's own launch announcement, naming ecosystem participants including Cloudflare |\n| Evidence | 6 verified | 2 verified, 2 reported |\n| Primary use case | Prove an agent's identity | Prove an agent's identity |\n| Last verified | 2026-10-23 (current) | 2026-10-23 (current) |\n| Specification | [https://datatracker.ietf.org/doc/draft-ietf-webbotauth-httpsig-protocol/](https://datatracker.ietf.org/doc/draft-ietf-webbotauth-httpsig-protocol/) | [https://developer.visa.com/capabilities/trusted-agent-protocol/trusted-agent-protocol-specifications](https://developer.visa.com/capabilities/trusted-agent-protocol/trusted-agent-protocol-specifications) |\n\n## When to use which\n\n- Choose Web Bot Auth HTTP Message Signatures when your question is “Which automated client made this HTTP request, and can the origin verify it cryptographically?” and you accept its maturity: status \"Active Internet-Draft, WG Document, Intended Status: Standards Track; expires 5 March 2027\", implementation multi-implementation (Cloudflare (edge verification, verified-bots program) and independent client/server implementations listed in the draft's own appendix).\n- Choose Visa Trusted Agent Protocol when your question is “How does a merchant recognize that an approved commerce agent, rather than a crawler or fraudulent bot, is interacting with its site or API?” and you accept its maturity: status \"Active vendor-led merchant specification\", implementation prototype (Visa's own launch announcement, naming ecosystem participants including Cloudflare).\n\nGuidance is derived from the two records (question, status, implementation, prerequisites, pairings), not from opinion. Each record's page carries its numbered references.\n\n## Read the full articles\n\n- [Web Bot Auth HTTP Message Signatures](/protocols/webbotauth/): Which automated client made this HTTP request, and can the origin verify it cryptographically?\n- [Visa Trusted Agent Protocol](/protocols/tap/): How does a merchant recognize that an approved commerce agent, rather than a crawler or fraudulent bot, is interacting with its site or API?\n\nAsk the MCP server to compare any two: the compare-protocols prompt, or get on both ids. [Connect](/connect/).\n\n[webbotauth.json](/data/protocols/webbotauth.json) · [tap.json](/data/protocols/tap.json) · [Markdown](/compare/webbotauth-vs-tap/index.md)\n"
}