AgentGrade

Web Bot Auth

Identity & trust · IETF webbotauth WG · Updated 2026-07-19

Status: Individual drafts under a chartered IETF working group (webbotauth, formed October 2025); not yet an RFC · Authoritative source

The emerging standard for cryptographically identifying automated clients: a profile of RFC 9421 that lets a bot prove which operator it belongs to, replacing spoofable User-Agent strings and brittle IP lists.

The IETF chartered the webbotauth working group in October 2025 to “standardize methods for cryptographically authenticating automated clients and providing additional information about their operators.” The core documents are still individual drafts — the protocol draft (draft-meunier-webbotauth-httpsig-protocol, June 2026) profiles RFC 9421 for bot identification, with companion drafts for the key-directory format and an operator registry.

Deployment is ahead of standardization. Cloudflare verifies Web Bot Auth signatures (Signature-Input, Signature, Signature-Agent headers) and runs a Signed Agents program whose initial signers included OpenAI’s ChatGPT agent, Block’s Goose, Browserbase, and Anchor Browser; in July 2026 it merged verified bots and signed agents into one directory distinguished by a direct-vs-intermediary access field. Cloudflare has also proposed a registry format — “a list of URLs at which to retrieve agent keys” — now an IETF draft.

The practical takeaway for site owners: signature verification is how the may-ignore-robots.txt tier of agent traffic becomes accountable. For agent operators: signing your fetcher’s requests is becoming the price of admission at CDN gates.

The three headers

Signature-Agent: "https://operator.example"
Signature-Input: sig1=("@authority" "signature-agent");created=…;keyid="…"
Signature: sig1=:…:

How AgentGrade checks it

AgentGrade’s Web Bot Auth checks verify whether a site publishes an RFC 9421 signatures directory at /.well-known/http-message-signatures-directory, declaring the keys its own agents sign with. Scan your site to see where you stand.

Related

All standards

RFC 9421 · Web Bot Auth · RFC 8615 · MCP · A2A · x402 · WebMCP · llms.txt · RFC 9309 · RFC 9110 · Index