--- title: "Trusted Agent Protocol or Web Bot Auth? Compared" url: https://knowyouragent.ch/en/knowledge/comparison/trusted-agent-protocol-or-web-bot-auth lang: en updated: 2026-10-17 license: © Innopulse Consulting GmbH --- # Trusted Agent Protocol or Web Bot Auth? Compared Two approaches answer the question of whose agent is visiting a website: Web Bot Auth from the Cloudflare and IETF environment and Visa's Trusted Agent Protocol. They build on the same technology and set different priorities. [Leutrim Miftaraj](https://knowyouragent.ch/en/about/leutrim-miftaraj), Founder, Innopulse Consulting GmbH Published 17 October 2026 ## Key points - Both approaches sign HTTP requests following RFC 9421 and prove whose agent is asking. - Web Bot Auth is meant generally for bots and agents; the Trusted Agent Protocol adds details for commerce. - Neither proves authority for a purchase; that requires a purchase intent or a mandate. ## What this is about [Web Bot Auth](https://knowyouragent.ch/en/knowledge/glossary/web-bot-auth) lets operators of bots and agents sign every request with [HTTP Message Signatures](https://knowyouragent.ch/en/knowledge/glossary/http-message-signatures) following RFC 9421. The website verifies the signature with the operator's published key. The approach is a draft in the IETF and is meant generally for automated traffic. Visa's [Trusted Agent Protocol](https://knowyouragent.ch/en/knowledge/glossary/trusted-agent-protocol) uses the same foundation and is aimed at commerce. It is meant to help merchants recognize trustworthy shopping agents and associate details about the consumer and the payment process. ## The comparison | Feature | Web Bot Auth | Trusted Agent Protocol | |---|---|---| | Origin | Cloudflare, draft in the IETF | Visa, developed with Cloudflare | | Foundation | RFC 9421 | RFC 9421 | | Audience | All websites, bots and agents | Merchants and shopping agents | | Additional details | Origin of the request | Details for commerce and payment | | Keys | Operator's directory | Agent operator's keys | | Verification in KYA | Signature following RFC 9421 | Signature following RFC 9421 | ## When to use what - **Web Bot Auth** for any website that wants to distinguish automated traffic and treat signed agents preferentially. - **Trusted Agent Protocol** for merchants in the card network who want to recognize shopping agents and connect them with the payment process. - **Both** can be verified side by side, because they build on the same signature technology. ## How the two work together A shop can verify Web Bot Auth signatures at the network edge and so separate signed agents from unsigned traffic. For the purchase itself, it evaluates the additional details from the Trusted Agent Protocol. Neither proves whether the customer wanted this purchase within these limits; that is what a signed purchase intent such as [Verifiable Intent](https://knowyouragent.ch/en/knowledge/glossary/verifiable-intent) is for. ## Common misconceptions - **“The approaches compete.”** They share the technology and differ in purpose. A shop can support both. - **“A Trusted Agent Protocol signature allows the purchase.”** It proves which agent is asking, not authority for a specific purchase. - **“Whoever verifies RFC 9421 verifies everything.”** The signature is the foundation; the key's origin and validity must also hold. ## The role of KYA KYA verifies RFC 9421 signatures as both approaches use them and reports the verdict without a mandate as indeterminate, because identity is not authority. The [RFC 9421 signature base](https://knowyouragent.ch/en/tools/rfc-9421-signature-base) tool shows the signature base; the comparison [Web Bot Auth or bot detection?](https://knowyouragent.ch/en/knowledge/comparison/web-bot-auth-or-bot-detection) explains the difference from bot detection. ## Decision guide in three questions - Do you want to distinguish automated traffic in general? Then verify Web Bot Auth signatures. - Are you a merchant in the card network wanting to connect shopping agents with the payment process? Then the Trusted Agent Protocol is added. - Do agents trigger purchases? Then additionally require a purchase intent or a mandate. ## Frequently asked questions ### What is the difference between the Trusted Agent Protocol and Web Bot Auth? Both sign requests following RFC 9421. Web Bot Auth is meant generally for bots and agents; the Trusted Agent Protocol is aimed at commerce and adds corresponding details. ### Must a shop support both approaches? Not necessarily. Because both build on RFC 9421, verification can be set up for both with little extra effort. ### Does a signature prove an agent's authority? No. It proves which operator is asking. Whether a purchase is on a customer's behalf is shown only by a purchase intent or a mandate. ### Who is behind the approaches? Web Bot Auth was proposed by Cloudflare and is being discussed in the IETF. The Trusted Agent Protocol comes from Visa and was developed with Cloudflare. ### What does KYA verify? The RFC 9421 signature, its base and the binding to the key. Without a mandate, the verdict stays indeterminate. ### Where do I find agent operators' keys? Operators publish their keys in a directory at a well-known address. The approaches' specifications describe where and in which format. ### Do the approaches also apply to agents in apps? Both are designed for HTTP requests and work regardless of whether an agent runs in a browser, in an app or on a server. ## Sources - Trusted Agent Protocol (Visa): [https://github.com/visa/trusted-agent-protocol](https://github.com/visa/trusted-agent-protocol) - Web Bot Auth: Architektur-Entwurf (IETF): [https://datatracker.ietf.org/doc/draft-meunier-web-bot-auth-architecture/](https://datatracker.ietf.org/doc/draft-meunier-web-bot-auth-architecture/) - RFC 9421: HTTP Message Signatures: [https://www.rfc-editor.org/rfc/rfc9421](https://www.rfc-editor.org/rfc/rfc9421) --- Quelle: https://knowyouragent.ch/en/knowledge/comparison/trusted-agent-protocol-or-web-bot-auth · KYA – Know Your Agent