Web Bot Auth

Identify Web Bot Auth is Cloudflare and IETF-draft profile of RFC 9421 HTTP Message Signatures whereby an AI crawler or agent signs its outbound HTTP requests with an Ed25519 private key and advertises its public key set (JWKS) at /.well-known/http-message-signatures-directory via a Signature-Agent header. Edge proxies and origin servers verify the signature cryptographically to confirm the agent's operator without relying on easily spoofed User-Agent strings or static IP lists. Used by: webbotauth, http-message-signatures, cloudflare-pay-per-crawl.