{
  "id": "web-bot-auth.verify",
  "protocol": "web-bot-auth",
  "layer": "identity-trust",
  "role": "merchant",
  "status": "recommended",
  "title": "Recognise signed agents with Web Bot Auth",
  "description": "Web Bot Auth uses HTTP Message Signatures and a public key directory so bots and agents can prove who they are. Mastercard incorporates it into Agent Pay; American Express said it will use it in its agentic commerce program (Cloudflare, 14 Oct 2025). Visa TAP is aligned with it per Visa's own spec.",
  "goal": "Lets you allow or charge verified agents and treat others differently, based on cryptography instead of user agent strings.",
  "note": "Based on IETF drafts (protocol: draft-ietf-webbotauth-httpsig-protocol-00); Cloudflare supports Ed25519. Agents host keys at /.well-known/http-message-signatures-directory.",
  "how_to_implement": {
    "steps": [
      "Turn on verified bots and agents at your CDN, or verify Signature headers yourself.",
      "For your own agent: generate an Ed25519 key, host the JWKS directory, register with Cloudflare."
    ],
    "snippet": {
      "lang": "sh",
      "code": "openssl genpkey -algorithm ed25519 -out private-key.pem\nopenssl pkey -in private-key.pem -pubout -out public-key.pem",
      "source_url": "https://developers.cloudflare.com/bots/reference/bot-verification/web-bot-auth/",
      "source_label": "Cloudflare: Web Bot Auth"
    }
  },
  "resources": [
    {
      "label": "Cloudflare: Web Bot Auth",
      "url": "https://developers.cloudflare.com/bots/reference/bot-verification/web-bot-auth/",
      "type": "docs",
      "publisher": "Cloudflare"
    },
    {
      "label": "Mastercard Developers: Level 1 agentic commerce",
      "url": "https://developer.mastercard.com/merchant-cloud/documentation/tutorials-and-guides/agentic-commerce-guide/21/",
      "type": "docs",
      "publisher": "Mastercard"
    },
    {
      "label": "Cloudflare press release: payments companies and Web Bot Auth (14 Oct 2025)",
      "url": "https://www.cloudflare.com/press/press-releases/2025/cloudflare-collaborates-with-leading-payments-companies-to-secure-and-enable-agentic-commerce/",
      "type": "announcement",
      "publisher": "Cloudflare"
    }
  ],
  "audit": {
    "method": "config_review",
    "automatable": false,
    "human": "Your CDN or verifier logs show signed agent requests as verified."
  },
  "how_to_verify": "Your CDN or verifier logs show signed agent requests as verified.",
  "artifacts": [
    "/.well-known/http-message-signatures-directory"
  ],
  "depends_on": [],
  "status_note": "Based on IETF drafts (protocol: draft-ietf-webbotauth-httpsig-protocol-00); Cloudflare supports Ed25519. Agents host keys at /.well-known/http-message-signatures-directory.",
  "verified": true,
  "slug": "web-bot-auth-verify",
  "category": "identity-trust",
  "url": "https://vreeman.ai/commerce/checklist#web-bot-auth.verify",
  "updated": "2026-10-19",
  "sources": [
    {
      "label": "Cloudflare: Web Bot Auth",
      "url": "https://developers.cloudflare.com/bots/reference/bot-verification/web-bot-auth/",
      "type": "docs",
      "publisher": "Cloudflare"
    },
    {
      "label": "Mastercard Developers: Level 1 agentic commerce",
      "url": "https://developer.mastercard.com/merchant-cloud/documentation/tutorials-and-guides/agentic-commerce-guide/21/",
      "type": "docs",
      "publisher": "Mastercard"
    },
    {
      "label": "Cloudflare press release: payments companies and Web Bot Auth (14 Oct 2025)",
      "url": "https://www.cloudflare.com/press/press-releases/2025/cloudflare-collaborates-with-leading-payments-companies-to-secure-and-enable-agentic-commerce/",
      "type": "announcement",
      "publisher": "Cloudflare"
    }
  ],
  "related_slugs": []
}