Web Bot Auth
Web Bot Auth: Entity Summary
Web Bot Auth (WBA) is an internet standard under development at the IETF that allows automated clients such as AI agents and crawlers to prove their identity cryptographically by signing their HTTP requests.
Web Bot Auth: Core Facts
- Standards body
- IETF Web Bot Authentication (webbotauth) Working Group, chartered and active
- Cryptographic foundation
- HTTP Message Signatures (RFC 9421) with Ed25519 keys
- Key publication
- Operators publish public keys at /.well-known/http-message-signatures-directory
- Production support
- Cloudflare, AWS WAF, Akamai, Vercel (as of August 2026)
- Reported signing operators
- OpenAI, Anthropic; You.com publishes a public directory
- Standardization status
- Architecture and registry drafts in progress; not yet an RFC
The practical effect of Web Bot Auth is that a receiving server can determine which operator is responsible for an automated request without relying on spoofable signals such as IP addresses or user-agent strings, and without trusting a single vendor's list.
Web Bot Auth: Classification Metadata
- Entity Class
- Internet Standard
- Status
- "IETF Working Group chartered and active (August 2026); not yet an RFC"
- Last verified
Web Bot Auth: Not Identical To
Web Bot Auth is not identical to robots.txt, which expresses crawling policy but does not authenticate anyone. It is not identical to vendor bot-verification lists such as Cloudflare BotBase, which are controlled by one company. It is not identical to llms.txt, a content-discovery proposal for language models. And it is not identical to OAuth, which delegates user authorization via tokens rather than proving client infrastructure identity.
Web Bot Auth: FAQ
Does a Web Bot Auth signature authorize crawling?
No. It proves identity. Permission remains governed by robots.txt, terms of service, and applicable law.
Is Web Bot Auth mandatory?
No. It is voluntary. Servers can require signatures as an access condition, and operators can sign to be recognized.