Web Bot Auth

Web Bot Auth

The independent explainer for Web Bot Auth — the emerging IETF standard that lets AI agents prove who they are.

What is Web Bot Auth?

Web Bot Auth (WBA) is an emerging internet standard that lets automated clients — AI agents, crawlers, fetchers — prove who they are using cryptographic signatures instead of spoofable IP addresses and user-agent strings.

It is being developed by the IETF Web Bot Authentication (webbotauth) Working Group, building on two proven pieces:

  • HTTP Message Signatures (RFC 9421) — a standard way to sign HTTP requests
  • Ed25519 — a fast, modern signature scheme

Why it matters

The web is splitting into a machine web (agents talking to services) and a human web (content for people). Both sides need one thing first: knowing who is on the other side of the connection. Web Bot Auth is the border control for the machine web — and the trust anchor for everything that follows: verified crawling, fair crawling policies, agent payments.

How it works

  1. An agent operator generates an Ed25519 key pair
  2. Public keys are published in a key directory at /.well-known/http-message-signatures-directory
  3. Every HTTP request is signed (Signature, Signature-Input, Signature-Agent headers)
  4. The receiving server fetches the directory and verifies — now it knows exactly which operator is knocking

Status (August 2026)

  • IETF Working Group chartered and active — architecture and registry drafts in progress
  • In production: Cloudflare, AWS WAF, Akamai, Vercel
  • Signing their traffic: OpenAI, Anthropic and others
  • Not yet an RFC — the window for independent resources is now