Glossary

The vocabulary of Web Bot Auth — short, precise, linked.

Web Bot Auth (WBA) — IETF WG

Standard for authenticating automated clients on the web. Bots sign their HTTP requests; site operators verify the signatures against a published key directory.

HTTP Message Signatures — RFC 9421

IETF standard for signing HTTP requests and responses. Covers which header fields are signed and how. The cryptographic foundation Web Bot Auth builds on.

Ed25519

A modern elliptic-curve signature scheme: fast verification, small keys, deterministic signatures. The algorithm WBA uses.

Key Directory

The public endpoint where an agent operator publishes its signing keys as JSON Web Keys (JWKs): /.well-known/http-message-signatures-directory. Verifiers fetch it to check signatures.

Signature-Agent header

HTTP header that points verifiers to the signature agent (and its directory) that signed the request.

Signature Agent Card — Registry draft

Machine-readable metadata document describing a signing agent — name, operator, purpose. Part of the registry draft.

Verified Bots vs. Signed Agents

Verified Bots are checked by a vendor against its own lists (e.g. Cloudflare BotBase). Signed agents prove their identity cryptographically — vendor-neutral and self-sovereign.

JWK (JSON Web Key)

JSON format for cryptographic public keys. The format used in WBA key directories.