Web Bot AuthHTTP Message Signatures for automated traffic
The web grew an identity layer for non-human traffic before finance grew an authority layer for it, and every payments protocol now assumes the former exists.
What it is
Web Bot Auth is a set of IETF internet-drafts, led from Cloudflare, that apply HTTP Message Signatures to automated traffic. An agent signs each request with a private key; the operator publishes the corresponding verification keys at a well-known location; the site verifies the signature and knows which operator's agent is calling, cryptographically rather than by reputation of a header string.
Cloudflare shipped it into its Verified Bots programme in 2025 and extended it to signed agents in August 2025, listing verified agents in a public directory. Major AI agents and crawlers now sign, and verification is implemented across several edge and bot-management vendors.
| Mechanism | HTTP Message Signatures; Ed25519 keys published at a well-known location |
|---|---|
| Status | Individual IETF drafts; working group activity ongoing, no adopted standard |
| Deployment | Verified in production by multiple edge and bot-management providers |
| Signed by | Major agent and crawler operators, listed in public directories |
What it proves and what it does not
A valid signature proves which operator's software sent the request. That is genuinely useful and genuinely limited. It does not establish which end user the agent is acting for, whether that user authorised this action, or whether the agent's reasoning was sound. An identity layer tells a merchant who is knocking; it says nothing about whether the visitor has the keys to the house.
The distinction matters most in the case everyone is worried about. Prompt injection does not forge a signature — it does not need to. It persuades a properly identified, properly signed, entirely legitimate agent to do the wrong thing. Identity is necessary. It is not what stops that.
What it does not do
- Attests the operator, not the principal: it does not carry who the agent is acting for or on what authority.
- Not yet an adopted standard; production deployment runs ahead of the drafts.
- Coverage depends on the verifier: sites not behind a participating provider see nothing.
- Says nothing about intent, and offers no defence against a legitimate agent being manipulated.
Where mnd8t sits relative to it
Foundational and complementary. Agent identity is an input to an authority decision — knowing which agent is asking is how a mandate is looked up in the first place. mnd8t identifies agents against registered credentials on its own side of the boundary; where a counterparty also wants signed proof at the edge, Web Bot Auth is the mechanism doing that.
Last reviewed 8 September 2026. Corrections: hello@mnd8t.com.