# Web Bot Auth

[2 · Identify](/category/identify/)

| Web Bot Auth |
| --- |
| Category | [Identify](/category/identify/) |
| Also known as | http-message-signatures-directory, verified bot signing |
| Related | [Web Bot Auth HTTP Message Signatures](/protocols/webbotauth/), [HTTP Message Signatures](/protocols/http-message-signatures/), [Cloudflare Pay per crawl](/protocols/cloudflare-pay-per-crawl/) |

[Identify](/category/identify/) Web Bot Auth is Cloudflare and IETF-draft profile of RFC 9421 HTTP Message Signatures whereby an AI crawler or agent signs its outbound HTTP requests with an Ed25519 private key and advertises its public key set (JWKS) at /.well-known/http-message-signatures-directory via a Signature-Agent header. Edge proxies and origin servers verify the signature cryptographically to confirm the agent's operator without relying on easily spoofed User-Agent strings or static IP lists. Used by: webbotauth, http-message-signatures, cloudflare-pay-per-crawl.

## Instances

Not applicable.

## See also

- [Web Bot Auth HTTP Message Signatures](/protocols/webbotauth/)
- [HTTP Message Signatures](/protocols/http-message-signatures/)
- [Cloudflare Pay per crawl](/protocols/cloudflare-pay-per-crawl/)

## References

- [https://developers.cloudflare.com/bots/reference/bot-verification/web-bot-auth/](https://developers.cloudflare.com/bots/reference/bot-verification/web-bot-auth/) (2026-09-05) VERIFIED
- [https://github.com/cloudflare/web-bot-auth](https://github.com/cloudflare/web-bot-auth) (2026-09-05) VERIFIED

[JSON](/terms/web-bot-auth/index.json) · [Markdown](/terms/web-bot-auth/index.md) · [OKF v0.2](/okf/terms/web-bot-auth.md)