{
  "@context": "https://schema.org",
  "@id": "https://webspecification.com/spec/agent-readiness/web-bot-auth.jsonld",
  "@graph": [
    {
      "@type": "TechArticle",
      "@id": "https://webspecification.com/spec/agent-readiness/web-bot-auth/#article",
      "headline": "Web Bot Auth — verifiable bot identity",
      "description": "Web Bot Auth lets a bot prove who it is by signing each HTTP request with a key it controls. Sites can then allow or block specific bots without IP allow-lists, user-agent strings, or guesswork. Built on RFC 9421 HTTP Message Signatures.",
      "url": "https://webspecification.com/spec/agent-readiness/web-bot-auth/",
      "inLanguage": "en",
      "isPartOf": {
        "@type": "WebSite",
        "@id": "https://webspecification.com/#website",
        "name": "Web Specification Studio",
        "url": "https://webspecification.com"
      },
      "author": {
        "@type": "Person",
        "name": "Web Specification Studio",
        "url": "https://webspecification.com"
      },
      "publisher": {
        "@type": "Organization",
        "@id": "https://webspecification.com/#organization",
        "name": "Web Specification Studio",
        "url": "https://webspecification.com"
      },
      "license": "https://creativecommons.org/licenses/by/4.0/",
      "dateModified": "2026-05-29T12:14:17.000Z",
      "citation": [
        {
          "@type": "CreativeWork",
          "name": "RFC 9421 — HTTP Message Signatures",
          "url": "https://www.rfc-editor.org/rfc/rfc9421",
          "publisher": {
            "@type": "Organization",
            "name": "IETF"
          }
        },
        {
          "@type": "CreativeWork",
          "name": "draft-meunier-web-bot-auth-architecture",
          "url": "https://datatracker.ietf.org/doc/html/draft-meunier-web-bot-auth-architecture",
          "publisher": {
            "@type": "Organization",
            "name": "IETF"
          }
        },
        {
          "@type": "CreativeWork",
          "name": "draft-meunier-http-message-signatures-directory",
          "url": "https://datatracker.ietf.org/doc/html/draft-meunier-http-message-signatures-directory",
          "publisher": {
            "@type": "Organization",
            "name": "IETF"
          }
        },
        {
          "@type": "CreativeWork",
          "name": "Cloudflare — Forget IPs: using cryptography to verify bot and agent traffic",
          "url": "https://blog.cloudflare.com/web-bot-auth/",
          "publisher": {
            "@type": "Organization",
            "name": "Cloudflare"
          }
        }
      ]
    },
    {
      "@type": "BreadcrumbList",
      "@id": "https://webspecification.com/spec/agent-readiness/web-bot-auth/#breadcrumb",
      "itemListElement": [
        {
          "@type": "ListItem",
          "position": 1,
          "name": "Home",
          "item": "https://webspecification.com/"
        },
        {
          "@type": "ListItem",
          "position": 2,
          "name": "Spec",
          "item": "https://webspecification.com/spec/"
        },
        {
          "@type": "ListItem",
          "position": 3,
          "name": "Agent Readiness",
          "item": "https://webspecification.com/spec/agent-readiness/"
        },
        {
          "@type": "ListItem",
          "position": 4,
          "name": "Web Bot Auth — verifiable bot identity",
          "item": "https://webspecification.com/spec/agent-readiness/web-bot-auth/"
        }
      ]
    }
  ]
}