{
 "acronym": "WebBotAuth",
 "adoption": {
  "by": "Cloudflare (edge verification, verified-bots program) and independent client/server implementations listed in the draft's own appendix",
  "level": "observed",
  "probe_run": null
 },
 "aliases": [
  "Web Bot Auth",
  "HTTP Message Signatures for automated traffic"
 ],
 "analog": "Signed User-Agent / client authentication",
 "collisions": [],
 "discovery": {
  "mechanism": "Signature-Agent HTTP header points to a key directory; the directory is fetched from a fixed well-known path",
  "path": "/.well-known/http-message-signatures-directory"
 },
 "dispute": null,
 "evidence": [
  {
   "claim": "The protocol defines the Signature-Agent header (profiling RFC 9421's Signature-Input/Signature fields) for in-band key discovery, and a well-known URI serving a JWKS-based key directory. The draft's own appendix lists independent public client implementations (Chrome MV3 and Cloudflare Workers/Rust libraries by Cloudflare, a Puppeteer example, a Guzzle/PHP middleware, Python scripts) and server implementations (Cloudflare Workers, a Caddy plugin, an Apache module).",
   "date": "2026-06-26",
   "label": "VERIFIED",
   "url": "https://datatracker.ietf.org/doc/html/draft-meunier-webbotauth-httpsig-protocol-00"
  },
  {
   "claim": "As of 2026-09-01 the document was adopted by the IETF webbotauth Working Group as draft-ietf-webbotauth-httpsig-protocol-00, superseding the individual submission",
   "date": "2026-09-01",
   "label": "VERIFIED",
   "url": "https://datatracker.ietf.org/doc/draft-ietf-webbotauth-httpsig-protocol/"
  },
  {
   "claim": "Cloudflare verifies Web Bot Auth signatures at the edge as part of its Verified Bots program, requiring the key directory at /.well-known/http-message-signatures-directory and specific Signature-Input parameters (tag=web-bot-auth, keyid, created, expires)",
   "date": "2026-07-01",
   "label": "VERIFIED",
   "url": "https://developers.cloudflare.com/bots/reference/bot-verification/web-bot-auth/"
  }
 ],
 "form": "http-header",
 "governance": "IETF webbotauth Working Group (chartered; document adopted as a WG item 2026-09-01)",
 "group": "Web Bot Auth family",
 "history": [
  {
   "date": "2026-09-05",
   "note": "seeded from Exa Agent research run"
  },
  {
   "date": "2026-09-06",
   "note": "verified against draft-meunier-webbotauth-httpsig-protocol-00, its WG-adopted successor draft-ietf-webbotauth-httpsig-protocol-00 (2026-09-01), and Cloudflare's Web Bot Auth integration docs"
  }
 ],
 "id": "webbotauth",
 "implementation": "multi-implementation",
 "last_verified": "2026-09-06",
 "name": "Web Bot Auth HTTP Message Signatures",
 "native_status": "Active Internet-Draft, WG Document, Intended Status: Informational",
 "origin": {
  "date": "2025-04",
  "org": "Thibault Meunier (Cloudflare), Sandor Major (Google)"
 },
 "part_of": null,
 "parties": [
  "agent-site"
 ],
 "phase": "working-group",
 "probe": {
  "method": "GET",
  "on_absent": "No published key directory; the origin cannot verify Web Bot Auth signatures from this Signature-Agent identity",
  "parse": "200 response with Content-Type: application/http-message-signatures-directory+json and a JWKS body ({\"keys\":[...]}), itself signed with a Signature/Signature-Input pair tagged http-message-signatures-directory",
  "path": "https://{origin}/.well-known/http-message-signatures-directory"
 },
 "question": "Which automated client made this HTTP request, and can the origin verify it cryptographically?",
 "scope": "general",
 "spec_url": "https://datatracker.ietf.org/doc/draft-ietf-webbotauth-httpsig-protocol/",
 "step": "identify",
 "summary_md": "Web Bot Auth is an IETF specification that lets an automated HTTP client (a crawler, agent, or bot) cryptographically sign its outbound requests using RFC 9421 HTTP Message Signatures, so the receiving server can verify the client's identity and intent without relying on spoofable signals like the User-Agent string or source IP [1]. A client sends a Signature-Agent header naming where its public keys can be found; the origin resolves that to a JSON Web Key Set served at a fixed well-known path and verifies the request's Signature/Signature-Input fields against it [1].\n\nIt solves bot/agent attribution at the transport layer: an origin can distinguish a signed, identity-bearing automated client from unsigned traffic, and can grant differentiated treatment (rate limits, access, billing) based on a verified identity rather than heuristics [1][3]. It does not define what a client is *authorized* to do once verified (that is left to the origin's own policy), does not cover payment, and does not itself specify how a verifier should be told which identities to trust — that is the job of the companion Signature Agent Card / registry draft.\n\nCurrent state: originally an individual submission (draft-meunier-webbotauth-httpsig-protocol, first published 2025-04, reaching -00 of the current \"httpsig-protocol\" naming on 2026-06-26). On 2026-09-01 it was formally adopted as a document of the newly chartered IETF **webbotauth** Working Group, republished as draft-ietf-webbotauth-httpsig-protocol-00 [2]. Intended status is Informational, not yet a Working Group last call or RFC.\n\nWho implements it: Cloudflare verifies Web Bot Auth signatures at the edge for its Verified Bots program and publishes an integration guide with the exact required headers and the /.well-known/http-message-signatures-directory path [3]. The draft's own appendix lists further independent implementations: a Chrome MV3 extension and Rust/TypeScript libraries from Cloudflare, a Puppeteer-based client example, a PHP Guzzle middleware, Python scripts, and server-side modules for Caddy and Apache [1]. Cloudflare previously reported signing bots from OpenAI as an early adopter (2025-05-15, per the prior seed research; not independently re-verified in this pass).\n\nDisputed or unknown: the spec's naming and draft numbering have churned repeatedly (it replaces draft-meunier-web-bot-auth-architecture and draft-meunier-webbotauth-httpsig-directory), which makes citing a stable version number difficult; always resolve to the datatracker's \"current\" redirect rather than a pinned draft-NN URL. Adoption beyond Cloudflare's own edge and the listed open-source projects has not been independently counted.",
 "track": "ietf",
 "version": {
  "date": "2026-09-01",
  "label": "draft-ietf-webbotauth-httpsig-protocol-00, adopted by the webbotauth WG, last updated 2026-09-01 (supersedes the individual draft-meunier-webbotauth-httpsig-protocol-00 of 2026-06-26)"
 },
 "url": "https://agenticweb.wiki/protocols/webbotauth/",
 "category": "identify",
 "type": "protocol"
}