---
type: Glossary Term
title: "Web Bot Auth"
description: "Web Bot Auth is Cloudflare and IETF-draft profile of RFC 9421 HTTP Message Signatures whereby an AI crawler or agent signs its outbound HTTP requests with an Ed25519 private key and advertises its public key set (JWKS) at /.well-known/http-message-signatures-directory via a Signature-Agent header."
resource: "https://agenticweb.wiki/terms/web-bot-auth/"
tags: ["glossary", "identify"]
status: stable
generated: { by: agenticweb-builder/1.0, at: 2026-10-23T00:00:00Z }
verified: { by: process:agenticweb-engine, at: 2026-10-23T00:00:00Z }
stale_after: 2026-11-22T00:00:00Z
sources:
  - id: ref-1
    resource: "https://developers.cloudflare.com/bots/reference/bot-verification/web-bot-auth/"
    last_modified: 2026-09-05T00:00:00Z
  - id: ref-2
    resource: "https://github.com/cloudflare/web-bot-auth"
    last_modified: 2026-09-05T00:00:00Z
---

# Web Bot Auth

**Web Bot Auth** is Cloudflare and IETF-draft profile of **RFC 9421 HTTP Message Signatures** whereby an AI crawler or agent signs its outbound HTTP requests with an Ed25519 private key and advertises its public key set (JWKS) at `/.well-known/http-message-signatures-directory` via a `Signature-Agent` header. Edge proxies and origin servers verify the signature cryptographically to confirm the agent's operator without relying on easily spoofed `User-Agent` strings or static IP lists. Used by: webbotauth, http-message-signatures, cloudflare-pay-per-crawl.

# Knowledge Graph

* **Related standards**: [Web Bot Auth HTTP Message Signatures](/okf/protocols/webbotauth.md), [HTTP Message Signatures](/okf/protocols/http-message-signatures.md), [Cloudflare Pay per crawl](/okf/protocols/cloudflare-pay-per-crawl.md)

[^ref-1]: https://developers.cloudflare.com/bots/reference/bot-verification/web-bot-auth/ (https://developers.cloudflare.com/bots/reference/bot-verification/web-bot-auth/)
[^ref-2]: https://github.com/cloudflare/web-bot-auth (https://github.com/cloudflare/web-bot-auth)