{
 "id": "web-bot-auth",
 "name": "Web Bot Auth",
 "aliases": [
  "http-message-signatures-directory",
  "verified bot signing"
 ],
 "definition_md": "**Web Bot Auth** is Cloudflare and IETF-draft profile of **RFC 9421 HTTP Message Signatures** whereby an AI crawler or agent signs its outbound HTTP requests with an Ed25519 private key and advertises its public key set (JWKS) at `/.well-known/http-message-signatures-directory` via a `Signature-Agent` header. Edge proxies and origin servers verify the signature cryptographically to confirm the agent's operator without relying on easily spoofed `User-Agent` strings or static IP lists. Used by: webbotauth, http-message-signatures, cloudflare-pay-per-crawl.",
 "step": "identify",
 "related_protocols": [
  "webbotauth",
  "http-message-signatures",
  "cloudflare-pay-per-crawl"
 ],
 "sources": [
  {
   "url": "https://developers.cloudflare.com/bots/reference/bot-verification/web-bot-auth/",
   "date": "2026-09-05",
   "label": "VERIFIED"
  },
  {
   "url": "https://github.com/cloudflare/web-bot-auth",
   "date": "2026-09-05",
   "label": "VERIFIED"
  }
 ],
 "part_of": null,
 "group": null,
 "url": "https://agenticweb.wiki/terms/web-bot-auth/",
 "okf_url": "https://agenticweb.wiki/okf/terms/web-bot-auth.md",
 "category": "identify",
 "type": "term"
}