agent-ready-web-bot-auth

Bot request verification authenticates automated traffic by validating signed requests containing Signature-Agent and Signature-Input headers against a published JWKS. This allows receiving websites to confirm the origin and integrity of machine traffic.

IETF Web Bot Auth is a standard for making bot requests verifiable and trusted through HTTP message signatures. It works by signing outbound requests with cryptographic keys and publishing a JWKS at a well-known directory for public discovery.

Yes, Cloudflare bot verification supports IETF Web Bot Auth for automated agents. You can implement Web Bot Auth to make machine traffic verifiable and validate the setup using an agent readiness scanner.

Publishing a JWKS for HTTP message signatures involves configuring a JSON Web Key Set at the required well-known HTTP directory endpoint. This enables public key discovery so receiving systems can validate signed bot requests.

Signing outbound bot requests requires the Signature-Agent and Signature-Input headers. These headers contain the cryptographic message signatures that receiving websites use to verify the request's origin and integrity.

Signed bot requests fail verification when the receiving system cannot access the JWKS at the well-known endpoint or the Signature-Agent and Signature-Input headers are missing. Ensure your public key is discoverable and requests are properly signed.