What is Web Bot Auth?
Web Bot Auth is an authentication method that uses cryptographic signatures in HTTP messages so a website can verify that a request comes from a particular automated bot or agent.
Why does Web Bot Auth matter for marketers?
As AI agents act for users, sites need a way to tell a legitimate agent from abusive automation. Arkose Labs reported in October 2026 that 97.7% of legitimate AI agent sessions carried no verified signature.
Where does Web Bot Auth stand today?
Cloudflare's documentation says Web Bot Auth builds on two IETF drafts, one for sharing public keys and one for attaching a bot's identity to requests, and does not describe the protocol as a finalised standard. Bots publish a public key directory and attach Signature-Input, Signature and Signature-Agent headers once verified. Cloudflare's implementation does not support some RFC 9421 components. Arkose said ChatGPT agent signed 78.4% of its sessions.
Common use cases
- Verifying a legitimate agent or crawler
- Setting different rules for verified and unverified bots
- Reducing false blocks of customers' agents
Per Cloudflare, a bot generates an Ed25519 signing key and publishes the public key in a JSON Web Key Set at a well-known address, served over HTTPS and signed. It then registers the directory with Cloudflare, and after verification attaches the signature headers to its requests.
Who it is for
The Cloudflare page is written for bot and agent operators who want verified status; it gives site owners little guidance beyond contacting support to disable Web Bot Auth verification for a zone. Cloudflare said on October 16, 2026 that it will also grade verified bots on robots.txt compliance and behaviour after HTTP 429 responses.