{
 "id": "anonymous-bot-auth",
 "name": "Anonymous Bot Authentication",
 "acronym": "ABA",
 "aliases": [
  "draft-rescorla-anonymous-webbotauth",
  "Anonymous Bot Authentication: Authorization and Rate Limiting for Web Agents"
 ],
 "collisions": [],
 "step": "identify",
 "parties": [
  "agent-site"
 ],
 "form": "endpoint",
 "track": "ietf",
 "scope": "general",
 "question": "How can a site tell authorised, well-behaved bots from others, and rate-limit them, without learning which bot sent each request?",
 "analog": "A members-only pass that proves you belong to a club without showing your name",
 "origin": {
  "org": "E. Rescorla (Independent), R. Barnes (Cisco)",
  "date": "2026-04-08"
 },
 "governance": "Individual Internet-Draft, not adopted by a working group; source at github.com/ekr/draft-rescorla-anonymous-webbotauth",
 "native_status": "Active Internet-Draft, Intended Status: Informational; expires 20 January 2027; the draft says it 'has not yet seen significant security analysis'",
 "phase": "draft",
 "implementation": "unknown",
 "adoption": {
  "level": "unmeasured",
  "by": null,
  "probe_run": null
 },
 "version": {
  "label": "draft-rescorla-anonymous-webbotauth-01",
  "date": "2026-07-19"
 },
 "spec_url": "https://datatracker.ietf.org/doc/draft-rescorla-anonymous-webbotauth/",
 "discovery": {
  "mechanism": "None at an origin: a bot registers with a credential Anchor, receives an Endorsement, redeems it with a Moderator (run by or for the site) for an anonymous Credential and presents that Credential; the concrete design uses the MoLE architecture",
  "path": null
 },
 "probe": {
  "method": "NONE",
  "path": "",
  "parse": "",
  "on_absent": "The draft defines no site-side artefact, so support cannot be observed from a site's public endpoints."
 },
 "evidence": [
  {
   "claim": "Datatracker lists draft-rescorla-anonymous-webbotauth-01 as an active individual Internet-Draft by E. Rescorla (Independent) and R. Barnes (Cisco), Informational, dated 2026-07-19 and expiring 2027-01-20.",
   "date": "2026-07-19",
   "label": "VERIFIED",
   "url": "https://datatracker.ietf.org/doc/draft-rescorla-anonymous-webbotauth/"
  },
  {
   "claim": "The -01 text describes Anonymous Bot Authentication: bots register with an Anchor and receive anonymous credentials, so a site learns only that a request comes from some bot the Anchor endorsed. It supports per-bot rate limiting, separate content for bots, access conditioned on criteria, traffic classification and unlinkability, but not allow or deny lists of individual bots or auditing; the concrete instantiation uses MoLE (draft-jms-mole-architecture), and it contrasts itself with the signature-based draft-meunier-webbotauth-httpsig-protocol.",
   "date": "2026-07-19",
   "label": "VERIFIED",
   "url": "https://www.ietf.org/archive/id/draft-rescorla-anonymous-webbotauth-01.html"
  }
 ],
 "summary_md": "Anonymous Bot Authentication (ABA) is an individual IETF draft by Eric Rescorla and Richard Barnes that offers a privacy-preserving alternative to signature-based Web Bot Auth [1][2]. Bots register with a credential Anchor, which checks them against its policy and issues an anonymous credential. The bot redeems it with a Moderator, run by or cooperating with the site, for a credential it presents later; the site learns only that the request comes from some bot that Anchor endorsed, not which one [2]. The concrete design builds on the MoLE anonymous-endorsement architecture [2].\n\nThe authors argue that identifying every bot lets sites discriminate against bots acting in the public interest, such as price comparison or monitoring for discrimination, and stops people fetching content anonymously with automated tools [2]. ABA keeps per-bot rate limiting, separate content for bots, access based on criteria, and bot-versus-human classification. It gives up allow and deny lists of individual bots and auditing of what a given bot did [2]. A site can still treat Anchors differently, and IP addresses or fingerprinting may still identify a bot by other means [2].\n\nCurrent state: -01 of 2026-07-19 (the -00 appeared on 2026-04-08), Informational, expiring 2027-01-20, not adopted by the webbotauth WG [1]. The draft says it has not yet had significant security analysis, and no implementation was found.",
 "part_of": null,
 "group": null,
 "use_cases": [
  "prove-agent-identity",
  "attribute-agent-traffic",
  "control-ai-crawling"
 ],
 "audience": [
  "site-owner",
  "platform",
  "standards-body"
 ],
 "pairs_with": [
  "webbotauth",
  "jafar",
  "web-bot-auth-signature-agent-card"
 ],
 "prerequisites": [],
 "dispute": null,
 "last_verified": "2026-10-20",
 "history": [
  {
   "date": "2026-10-20",
   "note": "added from gap scout 2026-10-20; verified against the datatracker page (via Exa) and the -01 text (IETF rsync mirror)"
  }
 ],
 "watch": [
  {
   "type": "ietf",
   "doc": "draft-rescorla-anonymous-webbotauth"
  }
 ],
 "freshness": "current"
}