Agent Wranglers

AGT-56Optional

Sign your bot's requests

If you run a crawler or agent, sign its requests with Web Bot Auth. As a site, don't block unsigned bots by default.

By Agent Wranglers. Updated .

How to do it

If you run a bot, sign each request with HTTP Message Signatures (RFC 9421), using tag="web-bot-auth". Send Signature-Agent as a dictionary that names your key directory, as in the example. Publish your public keys at /.well-known/http-message-signatures-directory on that domain, as application/http-message-signatures-directory+json. The keyid is the key's JWK SHA-256 thumbprint. As a site, verify signatures where you need to tell bots apart, as in verify who an agent is. Web Bot Auth is an IETF working group draft from 2026, so expect changes.

Examples

HTTP example

GET /page HTTP/1.1
Host: example.com
Signature-Agent: sig1="https://bot.example.com"
Signature-Input: sig1=("@authority" "signature-agent";key="sig1");created=1760000000;expires=1760000300;keyid="poqkLGiymh_W0uP6PZFw-dvez3QJT5SolqXBCW38r0U";tag="web-bot-auth"
Signature: sig1=:base64signature...:

How to check

A verifier, such as the open-source libraries linked from the draft, accepts your signed request. The key directory answers 200 over HTTPS.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/agents-as-users/ready-for-ai-agents/web-bot-auth">Agent Wranglers agents as users playbook</a>. In code you write, add a comment next to it with the same link.