Aethelforge
Read the Index

Research · Standards

What a signed agent request looks like on the wire

Web Bot Auth is how an assistant identifies itself to a website: three headers, an Ed25519 key, and a directory where the key is published. Here is what to read, and how the Index counts it.

Published 24 Sep 20263 min readAethelforge editors

In one paragraph

How does an AI agent identify itself to a website?

Under Web Bot Auth it signs each request with an Ed25519 key using RFC 9421 HTTP message signatures and adds a Signature-Agent header naming the directory where its public key is published. A site verifies the signature against that key.

Have you ever looked at the request an assistant sends when it fetches a page for someone? For most of the web's history there was nothing to look at. A bot announced itself, if it announced itself at all, with a user-agent string, and a user-agent string is a claim anyone can make. Amazon's complaint about Muse in September, that the assistant browses without identifying itself, is the old problem stated by the largest merchant on earth. The interesting part is that the web already has an answer, and it fits in three headers.

The three headers

Web Bot Auth is a small profile of a larger standard. RFC 9421, HTTP Message Signatures, defines how any HTTP message can carry a signature over selected parts of itself. Web Bot Auth says which parts an agent should cover, which algorithm it should use, and, crucially, how a site can find the key. A signed request looks like this:

GET /services HTTP/1.1
Host: example-clinic.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) …
Signature-Agent: "https://agent-directory.example"
Signature-Input: sig1=("@authority" "signature-agent");created=1758700000;expires=1758700300;keyid="poqkLGiymh_W0uP6PZFw-dvez3QJT5SolqXBCW38r0U";alg="ed25519";tag="web-bot-auth"
Signature: sig1=:jdq0SqOwHdyHr9+r5jw3iYZH6aNGKijYp/EstF4RQTQdi5N5YYKrD+mCT1HA1nZDsi6nJKuHxUi/5Syp3rLWBA==:

Three things are worth noticing. The user agent is a browser string; nothing in it says "agent". The Signature-Agent header names a directory, and at that directory the agent publishes a JSON Web Key Set containing the Ed25519 public key whose id appears in Signature-Input. And the signature covers the authority the request was sent to, so a signature captured on one site cannot be replayed against another.

Verification is what you would expect. Fetch the key set from the directory, select the key by id, check that the current time falls inside the created and expires window, reconstruct the signature base from the covered components, and verify the signature. An agent that passes has proved possession of a key that a named directory vouches for. That is identity, and it is the identity Amazon asked Muse for.

Who is already doing this

The mechanism is further along in deployment than in standardisation. As of September 2026 the drafts remain individual submissions at the IETF rather than working-group documents. Meanwhile, Cloudflare, AWS, Akamai, HUMAN and Vercel verify the signatures in production, and Cloudflare added a Verified AI Agent category to its bot management in June, reporting nineteen verified agents that together account for roughly 84 percent of the AI browser traffic it can identify. Cloudflare and GoDaddy announced a partnership in the same period around an open agentic web built on the mechanism. In other words, the major assistants sign, and the major edges check.

Whether every assistant signs is a different question. Meta has not said that Muse does, and Amazon's complaint suggests that on Amazon's store, at least, it does not.

What a business can read for itself

Not every business sits behind an edge that verifies these signatures and passes the verdict along, and a site should not need one to know whether an agent declared itself. The header is in the request. That is the principle the Index runs on: the middleware on every monitored site reads Signature-Agent on every request it sees, labels the request a declared agent when the header is present, and tracks the agent under the host of its key directory. A signing agent with a browser user agent is still counted as declared, because the signature, not the string, is the declaration.

Two further classes are read from the same request. Fetchers that assistants publish patterns for, such as the user agent an assistant uses when a person asks it to open a page, are counted as agent fetches, which is the reading layer doing a human errand. Everything else that is plainly not a browser is a crawler or an unknown bot. The current edition reports all four kinds for the web channel, and the declared-agent count is the one to watch.

Why the signature matters more than the block

Keep in mind that the point of reading the signature is not to keep signed agents out. It is the opposite. A signed agent has done what a business should ask of every visitor at its front door: said who it is, in a way that can be checked. The reasonable response is a lane, with the request routed to structured intake and receipted, while an unsigned request that behaves like an agent gets a challenge rather than a refusal. The standards page describes both mechanisms, and the challenge demo runs the 402 exchange live against this site.

FAQ

Questions this note answers.

  1. 01Which headers does a signed agent request carry?

    Three: Signature-Agent, which names the agent's key directory; Signature-Input, which lists the covered components, the key id, the algorithm and the validity window; and Signature, the base64 Ed25519 signature over those components.

  2. 02Who verifies Web Bot Auth signatures today?

    Cloudflare, AWS, Akamai, HUMAN and Vercel verify them in production. Cloudflare added a Verified AI Agent category to its bot management in June 2026, and by September reported nineteen verified agents making up roughly 84 percent of the AI browser traffic it could identify.

  3. 03Is Web Bot Auth an official standard?

    Not yet. The drafts are individual submissions at the IETF rather than working-group documents, but the mechanism is deployed widely enough that it functions as the de facto standard for agent identity on the web.

  4. 04How does the Index count a signed request?

    The middleware on every monitored site reads the Signature-Agent header on each request. A request that carries one is labelled a declared agent and tracked under the host of its key directory, even when its user agent string looks like an ordinary browser.