Agent Readiness CompareA square mark containing five stacked bars, the fourth in ultramarine.Agent Readiness Compare

STANDARD · §2.8 · TRUST · LAST REVIEWED SEPTEMBER 2026

What is Web Bot Auth?

A cryptographic answer to "which agent is this, really?"

Agent Readiness Compare editors · Spec status checked September 2026

Answer

Web Bot Auth is an authentication method that uses cryptographic signatures in HTTP messages to verify that a request comes from a particular automated client. It builds on HTTP Message Signatures (RFC 9421) and two IETF Internet-Drafts. A bot operator publishes its public keys in a key directory; sites or CDNs verify the signature. Cloudflare and Vercel both document support for verifying it.

Maintainer:
IETF Internet-Drafts
Status:
drafts (not yet RFCs)
Spec:
draft-meunier-webbotauth-httpsig-protocol

1.Why do sites need it?

User agent strings can be copied by anyone, so a site that allows 'GPTBot' by name also allows anything that claims that name. Web Bot Auth replaces the claim with a signature the site can check. That lets a site treat verified agents differently from unknown automation: allow them through a bot challenge, rate-limit them separately, or log them for analytics.

2.How does it work?

  1. The bot operator generates an Ed25519 signing key.
  2. It hosts a key directory at /.well-known/http-message-signatures-directory over HTTPS.
  3. It signs requests using HTTP Message Signatures (RFC 9421).
  4. The receiving site or CDN fetches the key directory and verifies each signature. On Cloudflare, operators register through the Bot Submission Form, choosing 'Request Signature' and providing the key directory URL.

The two drafts are draft-meunier-http-message-signatures-directory (sharing public keys) and draft-meunier-webbotauth-httpsig-protocol (how keys attach identity to requests), which replaced the earlier architecture draft.

3.What does Web Bot Auth not do?

  • It proves which operator sent a request. It does not prove which person the agent acts for; that needs OAuth or a commerce identity layer.
  • It does not decide policy. The site still chooses what verified agents may do.
  • It is not yet an RFC. Expect changes.

4.Who supports it?

  • Cloudflare documents Web Bot Auth as a bot verification method (docs updated July 1, 2026).
  • Vercel announced that its bot verification supports Web Bot Auth, and BotID exposes isVerifiedBot, verifiedBotName and verifiedBotCategory fields. Vercel maintains a verified bot directory at bots.fyi.
  • Readiness scanners check it: ora.ai's AgentReady specification lists Web Bot Auth under identity and access, and Cloudflare Is It Agent Ready lists it under bot access control.

5.Where does it sit in the readiness stack?

Layer 5, Trust.

L1 DISCOVER

Can an agent find you, and is it allowed in?

robots.txt (RFC 9309)Sitemapsllms.txtA2A Agent Card

Cloudflare AI Crawl Control (controls crawler access); ora.ai Scan (checks it); Cloudflare Is It Agent Ready (checks it)

L2 READ

Can it read and understand what you offer?

llms.txtMarkdown negotiation (Accept: text/markdown)JSON-LD

Cloudflare Markdown for Agents (serves markdown); ora.ai Scan (checks it)

L3 ACT

Can it complete a task on your site or API?

MCPWebMCPagents.jsonOpenAPI

Cloudflare (hosts MCP servers); Vercel (hosts MCP servers); nekuda (builds WebMCP tools); ora.ai Journey and WebMCP audit (test it)

L4 PAY

Can it pay you?

x402ACPUCPMPP

Cloudflare Pay per crawl (private beta, for crawlers); ora.ai Scan payments layer (checks it)

L5 TRUST

Can you tell which agent it is, and on whose behalf it acts?

Web Bot AuthOAuth 2.0

Cloudflare (verifies signed bots); Vercel (verifies signed bots); Forter (links agentic shoppers to verified customer identities)

Figure 1. The readiness stack: five layers, the standards that address each, and the tools that document support.
Text version of the diagram
Text version of the readiness stack
LayerQuestionStandardsTools that document support
L1 DISCOVERCan an agent find you, and is it allowed in?robots.txt (RFC 9309); Sitemaps; llms.txt; A2A Agent CardCloudflare AI Crawl Control (controls crawler access); ora.ai Scan (checks it); Cloudflare Is It Agent Ready (checks it)
L2 READCan it read and understand what you offer?llms.txt; Markdown negotiation (Accept: text/markdown); JSON-LDCloudflare Markdown for Agents (serves markdown); ora.ai Scan (checks it)
L3 ACTCan it complete a task on your site or API?MCP; WebMCP; agents.json; OpenAPICloudflare (hosts MCP servers); Vercel (hosts MCP servers); nekuda (builds WebMCP tools); ora.ai Journey and WebMCP audit (test it)
L4 PAYCan it pay you?x402; ACP; UCP; MPPCloudflare Pay per crawl (private beta, for crawlers); ora.ai Scan payments layer (checks it)
L5 TRUSTCan you tell which agent it is, and on whose behalf it acts?Web Bot Auth; OAuth 2.0Cloudflare (verifies signed bots); Vercel (verifies signed bots); Forter (links agentic shoppers to verified customer identities)

Frequently asked questions

Do I need to implement Web Bot Auth on my website?

Sites usually verify rather than sign. If your CDN verifies Web Bot Auth, you mostly need a policy for verified agents. You sign requests only if you operate a bot or agent yourself.

Is Web Bot Auth the same as OAuth?

No. Web Bot Auth identifies the bot operator. OAuth grants an agent delegated access to a user's account.

Update, September 2026: see Web Bot Auth in 2026 for BotBase and current verification support.

Source: Cloudflare Web Bot Auth docs · Vercel BotID verified bots docs · Vercel changelog · RFC 9421 · ora.ai AgentReady post · isitagentready.com · Reviewed Sep 2026