Web Bot Auth — verifiable bot identity
type: TechArticle
description: Web Bot Auth lets a bot prove who it is by signing each HTTP request with a key it controls. Sites can then allow or block specific bots without IP allow-lists, user-agent strings, or guesswork. Built on RFC 9421 HTTP Message Signatures.
language: en
is part of: Web Specification Studio
author: Web Specification Studio
publisher: Web Specification Studio
license: https://creativecommons.org/licenses/by/4.0/
date modified: 2026-05-29T12:14:17.000Z
citation: RFC 9421 — HTTP Message Signatures
  type: CreativeWork
  publisher: IETF
citation: draft-meunier-web-bot-auth-architecture
  type: CreativeWork
  publisher: IETF
citation: draft-meunier-http-message-signatures-directory
  type: CreativeWork
  publisher: IETF
citation: Cloudflare — Forget IPs: using cryptography to verify bot and agent traffic
  type: CreativeWork
  publisher: Cloudflare

Web Specification Studio
type: WebSite

Web Specification Studio
type: Organization

breadcrumb
type: BreadcrumbList
item list element: Home
  type: ListItem
  position: 1
  item: https://webspecification.com/
item list element: Spec
  type: ListItem
  position: 2
  item: https://webspecification.com/spec/
item list element: Agent Readiness
  type: ListItem
  position: 3
  item: https://webspecification.com/spec/agent-readiness/
item list element: Web Bot Auth — verifiable bot identity
  type: ListItem
  position: 4
  item: https://webspecification.com/spec/agent-readiness/web-bot-auth/