---
title: "Sign your bot's requests · Agent Wranglers"
url: https://agentwranglers.se/playbook/agents-as-users/ready-for-ai-agents/web-bot-auth
id: AGT-56
level: Optional
updated: 2026-10-27
build: a2a6bdfed830
tokens: 775
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Sign your bot's requests

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Ready for AI agents](https://agentwranglers.se/playbook/agents-as-users/ready-for-ai-agents.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: AGT-56
- Level: Optional
- Chapter: [Ready for AI agents](https://agentwranglers.se/playbook/agents-as-users/ready-for-ai-agents.md)
- Rule: If you run a crawler or agent, sign its requests with Web Bot Auth. As a site, don't block unsigned bots by default.
- Check: A verifier, such as the open-source libraries linked from the draft, accepts your signed request. The key directory answers 200 over HTTPS.
- How: If you run a bot, sign each request with HTTP Message Signatures (RFC 9421), using `tag="web-bot-auth"`. Send `Signature-Agent` as a dictionary that names your key directory, as in the example. Publish your public keys at `/.well-known/http-message-signatures-directory` on that domain, as `application/http-message-signatures-directory+json`. The `keyid` is the key's JWK SHA-256 thumbprint. As a site, verify signatures where you need to tell bots apart, as in [verify who an agent is](https://agentwranglers.se/playbook/agents-as-users/identifying-agents/verify-web-bot-auth.md). Web Bot Auth is an IETF working group draft from 2026, so expect changes.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### HTTP example

```http
GET /page HTTP/1.1
Host: example.com
Signature-Agent: sig1="https://bot.example.com"
Signature-Input: sig1=("@authority" "signature-agent";key="sig1");created=1760000000;expires=1760000300;keyid="poqkLGiymh_W0uP6PZFw-dvez3QJT5SolqXBCW38r0U";tag="web-bot-auth"
Signature: sig1=:base64signature...:
```

## Sources

- [RFC 9421 (HTTP Message Signatures)](https://www.rfc-editor.org/rfc/rfc9421)
- [IETF draft (Web Bot Auth HTTP signatures protocol)](https://datatracker.ietf.org/doc/draft-ietf-webbotauth-httpsig-protocol/)

## Related rules

- AGT-1 [Verify who an agent is before you trust it](https://agentwranglers.se/playbook/agents-as-users/identifying-agents/verify-web-bot-auth.md) in Agents as users

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/agents-as-users/ready-for-ai-agents/web-bot-auth">Agent Wranglers agents as users playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [State your text-mining choice](https://agentwranglers.se/playbook/agents-as-users/ready-for-ai-agents/tdmrep.md)
- Next: [Explain how agents sign up](https://agentwranglers.se/playbook/agents-as-users/ready-for-ai-agents/auth-md.md)
- [Ready for AI agents](https://agentwranglers.se/playbook/agents-as-users/ready-for-ai-agents.md)