# Web Bot Auth HTTP Message Signatures (WebBotAuth) vs x401: HTTP Proof Requirement Protocol

The map lists them as complementary: sites and agents commonly implement both.

[2 Identify](/category/identify/) [Web Bot Auth HTTP Message Signatures](/protocols/webbotauth/) · [2 Identify](/category/identify/) [x401: HTTP Proof Requirement Protocol](/protocols/x401/)

|  | [Web Bot Auth HTTP Message Signatures](/protocols/webbotauth/) WebBotAuth | [x401: HTTP Proof Requirement Protocol](/protocols/x401/) |
| --- | --- | --- |
| Lifecycle step | 2 Identify: Who is this agent? Who is this site? | 2 Identify: Who is this agent? Who is this site? |
| Answers | Which automated client made this HTTP request, and can the origin verify it cryptographically? | How can a resource ask an agent to prove something about the person behind it, such as being a verified human, before serving a request? |
| Governed by | IETF webbotauth Working Group (chartered; document adopted as a WG item 2026-09-01) | Editors Daniel Buchner (Proof) and Bhushit Agarwal (Circle); Apache-2.0 repository proof/x401; Proof says it plans to submit x401 to the FIDO Alliance agentic authentication workgroup |
| Status (issuer's words) | Active Internet-Draft, WG Document, Intended Status: Standards Track; expires 5 March 2027 | Status: Draft, Version 0.2.0 (version 0.1.0 still published at /spec/0.1.0/); the spec page carries no date |
| Version | draft-ietf-webbotauth-httpsig-protocol-00, adopted by the webbotauth WG, 2026-09-01 (replaces the individual draft-meunier-webbotauth-httpsig-protocol, last revision -02 of 2026-08-18) (2026-09-01) | 0.2.0 (Draft) |
| Form / transport | HTTP header | HTTP header |
| Found at | /.well-known/http-message-signatures-directory | none — signalled per request on the protected resource, not at a fixed path |
| Implementation | multi-implementation — Cloudflare (edge verification, verified-bots program) and independent client/server implementations listed in the draft's own appendix | shipping — Proof (Superfluid named as a live implementation, 2026-09-22) |
| Evidence | 6 verified | 4 verified, 1 reported |
| Primary use case | Prove an agent's identity | Prove an agent's identity |
| Last verified | 2026-10-23 (current) | 2026-10-23 (current) |
| Specification | [https://datatracker.ietf.org/doc/draft-ietf-webbotauth-httpsig-protocol/](https://datatracker.ietf.org/doc/draft-ietf-webbotauth-httpsig-protocol/) | [https://x401.proof.com/spec/latest/](https://x401.proof.com/spec/latest/) |

## When to use which

- Choose Web Bot Auth HTTP Message Signatures when your question is “Which automated client made this HTTP request, and can the origin verify it cryptographically?” and you accept its maturity: status "Active Internet-Draft, WG Document, Intended Status: Standards Track; expires 5 March 2027", implementation multi-implementation (Cloudflare (edge verification, verified-bots program) and independent client/server implementations listed in the draft's own appendix).
- Choose x401: HTTP Proof Requirement Protocol when your question is “How can a resource ask an agent to prove something about the person behind it, such as being a verified human, before serving a request?” and you accept its maturity: status "Status: Draft, Version 0.2.0 (version 0.1.0 still published at /spec/0.1.0/); the spec page carries no date", implementation shipping (Proof (Superfluid named as a live implementation, 2026-09-22)).

Guidance is derived from the two records (question, status, implementation, prerequisites, pairings), not from opinion. Each record's page carries its numbered references.

## Read the full articles

- [Web Bot Auth HTTP Message Signatures](/protocols/webbotauth/): Which automated client made this HTTP request, and can the origin verify it cryptographically?
- [x401: HTTP Proof Requirement Protocol](/protocols/x401/): How can a resource ask an agent to prove something about the person behind it, such as being a verified human, before serving a request?

Ask the MCP server to compare any two: the compare-protocols prompt, or get on both ids. [Connect](/connect/).

[webbotauth.json](/data/protocols/webbotauth.json) · [x401.json](/data/protocols/x401.json) · [Markdown](/compare/webbotauth-vs-x401/index.md)