# Web Bot Auth directory

Public keys letting verified agents prove who they are.

**[Trust](/docs/trust)** · checked once per host (item type `web_bot_auth`) · 6 checks that can fail it

It is how an automated client proves its identity instead of being judged on a user-agent string, which is the basis of every allowlist that is not guesswork. We read the published key directory, so the population that can get it wrong is signing operators.

## Adoption

**Early production** (L2)

Several independent organisations run it in production, though it is still niche on the open web. Direction of travel: ▲ rising, as of 2026-08-22.

Shipping is ahead of the standard: OpenAI signs in production, Cloudflare, Vercel and Akamai verify, and Amazon Bedrock AgentCore signs by default, while the IETF working group has adopted no document of its own.

| Adopter | Depth | Evidence |
|---|---|---|
| OpenAI (signs ChatGPT agent and Operator requests) | production | [help.openai.com](https://help.openai.com/en/articles/11845367-chatgpt-agent-allowlisting) |
| Cloudflare (signed agents, Verified Bots) | production | [blog.cloudflare.com](https://blog.cloudflare.com/signed-agents/) |
| Vercel (verifies signatures) | production | [vercel.com](https://vercel.com/docs/headers/request-headers) |
| Amazon (Bedrock AgentCore Browser) | default-on | [coronium.io](https://www.coronium.io/blog/web-bot-auth-verifiable-ai-agents-2026) |

## What we check

Absence is never a finding: every check below runs only once `webBotAuthPresent` is true, so a site that has not
adopted this is not assessed on it and appears in no report.

| Check | Kind | Raises | On whose authority |
|---|---|---|---|
| `webBotAuthMalformedDirectory` | high severity | conformance, usability | specification (RFC 7517) |
| `webBotAuthMissingKeys` | high severity | usability | specification (draft-meunier-webbotauth-httpsig-directory-00 (2026-06-26)) |
| `webBotAuthInvalidKey` | high severity | conformance, usability | specification (RFC 7517 + RFC 9421 (per draft-meunier-webbotauth-httpsig-directory-00 §3)) |
| `webBotAuthPrivateKeyExposed` | high severity | conformance, usability, security | specification (RFC 7517) |
| `webBotAuthUnregisteredAlgName` | medium severity | conformance, usability | specification (draft-meunier-webbotauth-httpsig-directory-00 (2026-06-26) §3) |
| `webBotAuthWrongMediaType` | medium severity | conformance, usability | specification (draft-meunier-webbotauth-httpsig-directory-00 (2026-06-26)) |

## Examples

These are the fixtures the test suite runs through the real collector, not snippets written for a document.

- Correct: `test/e2e/test-pages/trust/correct.web-bot-auth.json`
- Present but wrong: `test/e2e/test-pages/trust/issues.web-bot-auth.json`

## Specifications

| Document | Revision | Kind |
|---|---|---|
| [draft-meunier-webbotauth-httpsig-directory (the directory format we implement)](https://datatracker.ietf.org/doc/draft-meunier-webbotauth-httpsig-directory/) | -00, 2026-06-26 | specification |
| [RFC 9421 — HTTP Message Signatures](https://datatracker.ietf.org/doc/html/rfc9421) | RFC 9421 | specification |
| [Cloudflare — Web Bot Auth verification](https://developers.cloudflare.com/bots/reference/bot-verification/web-bot-auth/) | living document | vendor profile |
| [Google — Web Bot Auth for crawlers](https://developers.google.com/crawling/docs/crawlers-fetchers/web-bot-auth) | living document | vendor profile |

Last re-read against the published documents: 2026-08-12.

**On pinning it.** This draft formally replaces `draft-meunier-http-message-signatures-directory`, which expired at -05. Note that the IETF working group has adopted no document of its own: as of 2026-08-12 all nine active drafts are individual submissions.