---
title: "Web Bot Auth: definition | KYA glossary"
url: https://knowyouragent.ch/en/knowledge/glossary/web-bot-auth
lang: en
updated: 2026-10-12
license: © Innopulse Consulting GmbH
---

# Web Bot Auth

Web Bot Auth is an approach in which bots and AI agents sign their HTTP requests cryptographically so that websites can reliably recognize the operator.

Web Bot Auth uses HTTP Message Signatures as defined in RFC 9421: every request carries a signature over selected parts such as path, host and time. The operator publishes its keys in a directory that the Signature-Agent header can point to. The website verifies the signature and knows whose agent is asking.

Cloudflare proposed the approach in 2025, and it is being developed further in the IETF. Some providers of AI agents already sign their requests this way.

## Example

A research agent fetches a product page and signs the request with its Ed25519 key. The website loads the public key from the operator's directory, verifies the signature and lets the agent through instead of blocking it as an unknown bot.

## How it differs

Web Bot Auth proves who sends a request, not whether the action is allowed. Bot detection guesses from behavior; Web Bot Auth proves origin with cryptography. For purchases, approaches such as Verifiable Intent or an [agent mandate](https://knowyouragent.ch/en/knowledge/glossary/agent-mandate) are added.

## In practice

- As a website: provide the key directories of the agents you want to allow and verify every signed request.
- As an agent operator: sign all requests and publish your keys at a stable address.
- For purchases, always combine the recognized identity with proof of authority, such as a mandate.

## Role in KYA

KYA verifies signed requests following Web Bot Auth against Cloudflare's reference implementation: signature base, Ed25519, ECDSA and RSA-PSS, plus the binding to the operator. Because identity is not authority, the verdict stays “indeterminate” without a mandate.

Related check: [Issuer](https://knowyouragent.ch/en/method/checks) (`issuer_resolution`). Is the key bound to the issuer – through a DID or because the [verifying party](https://knowyouragent.ch/en/knowledge/glossary/verifying-party) trusts it?

[Verify now: open a matching example](https://knowyouragent.ch/en/verify?beispiel=web-bot-auth)

## Frequently asked questions

### What is Web Bot Auth?

An approach in which bots and AI agents sign their HTTP requests. Websites verify the signature with the operator's published key and thereby reliably recognize who is asking.

### Does Web Bot Auth replace bot detection?

It complements it. Bot detection estimates from behavior; Web Bot Auth proves the origin of a request cryptographically. Unsigned traffic is still handled as before.

### Why is the result in KYA “indeterminate”?

Because a valid signature only proves whose agent is asking. Whether it was allowed to buy or book something only a mandate can show. KYA keeps these two statements apart on purpose.

## Sources

- [Web Bot Auth: architecture draft (IETF)](https://datatracker.ietf.org/doc/draft-meunier-web-bot-auth-architecture/)
- [RFC 9421: HTTP Message Signatures](https://www.rfc-editor.org/rfc/rfc9421)

## Related terms

- [HTTP Message Signatures (RFC 9421)](https://knowyouragent.ch/en/knowledge/glossary/http-message-signatures)
- [Trusted Agent Protocol](https://knowyouragent.ch/en/knowledge/glossary/trusted-agent-protocol)
- [AI agent](https://knowyouragent.ch/en/knowledge/glossary/ai-agent)
- [Verifying party](https://knowyouragent.ch/en/knowledge/glossary/verifying-party)

---
Quelle: https://knowyouragent.ch/en/knowledge/glossary/web-bot-auth · KYA – Know Your Agent