What Is Web Bot Auth? Verifying AI Agents
Web Bot Auth is a proposed standard for AI agents and crawlers to prove their identity: each request carries an HTTP Message Signature (RFC 9421) made with a key the operator publishes at its own domain, named in the Signature-Agent header.
User-agent strings and IP ranges are easy to fake or go stale. A signature can only be made by whoever holds the private key, and the public key lives at a well-known address on the agent operator's domain, so anyone can check it.
To verify, a site reads the Signature-Agent header, fetches the published keys, finds the one whose thumbprint matches the signature's keyid, rebuilds the signed parts of the request (at least its host) and checks the signature and its time window.
A valid signature says which operator sent the request. It does not say the request is welcome; that is still the site's decision, now made on facts rather than guesses.
In WebForms
WebForms checks Web Bot Auth signatures on every form submission and tags signed ones as verified AI agents with the operator's domain, which routing rules can act on.