Web Bot Auth
A bot identity verification mechanism proposed by Cloudflare in which agents sign requests with registered public keys to declare their identity and intent. Merchants use it to distinguish authorized agents from crawlers and to decide whether to allow access.
Timeline (last 90 days)
Even if the technology is ready, if the major AI companies do not adopt Web Bot Auth, blind spots will still exist in the identification layer.
When Web Bot Auth is implemented, the most easily underestimated step is the policy attached after identification, not the identification technology itself.
Web Bot Auth provides the enforcement point for policy, not the policy itself.
Web Bot Auth is an IETF draft that is still being developed.
Web Bot Auth has been validated by Cloudflare and AWS.
The core idea of Web Bot Auth is to have agents carry cryptographically signed credentials in requests, enabling the recipient to confirm that the request comes from a declared agent.
Web Bot Auth is a bot identity verification specification proposed by Cloudflare in 2025, built on existing standards such as HTTP message signatures, allowing agents to declare their intent (browsing only or preparing to check out).
Visa's Trusted Agent Protocol and Mastercard's Agent Pay are both built on Web Bot Auth proposed by Cloudflare: agents sign each request with a public key registered in a directory and state their intent (browsing or payment), and merchants verify the signature before letting them through.
All Facts (8)
When Web Bot Auth is implemented, the most easily underestimated step is the policy attached after identification, not the identification technology itself.
50%UnverifiedWeb Bot Auth provides the enforcement point for policy, not the policy itself.
50%UnverifiedWeb Bot Auth is an IETF draft that is still being developed.
50%UnverifiedWeb Bot Auth has been validated by Cloudflare and AWS.
50%UnverifiedThe core idea of Web Bot Auth is to have agents carry cryptographically signed credentials in requests, enabling the recipient to confirm that the request comes from a declared agent.
50%UnverifiedVisa's Trusted Agent Protocol and Mastercard's Agent Pay are both built on Web Bot Auth proposed by Cloudflare: agents sign each request with a public key registered in a directory and state their intent (browsing or payment), and merchants verify the signature before letting them through.
50%UnverifiedWeb Bot Auth is a bot identity verification specification proposed by Cloudflare in 2025, built on existing standards such as HTTP message signatures, allowing agents to declare their intent (browsing only or preparing to check out).
50%UnverifiedEven if the technology is ready, if the major AI companies do not adopt Web Bot Auth, blind spots will still exist in the identification layer.
50%