Implement Web Bot Auth (RFC 9421 HTTP Message Signatures with a Signature-Agent header) on a merchant server so it can cryptographically verify AI shopping-agent requests before allowlisting them through bot management

domain: developers.cloudflare.com · 6 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checkedcommunity attestations: 0✓ / 0✗

Steps

  1. Read the Web Bot Auth architecture: agent operators publish an Ed25519 public key at a well-known JWKS-style directory URL and sign every outbound request per RFC 9421
  2. Configure your edge/WAF (e.g. Cloudflare) to check incoming requests for a Signature and Signature-Agent header pair rather than relying on the spoofable User-Agent string
  3. Resolve the Signature-Agent URL to fetch the claimed operator's published key directory and verify the Ed25519 signature covers method, path, authority, and the agent field
  4. Map verified operator identities (e.g. https://chatgpt.com for ChatGPT Agent, https://agent.bot.goog for Google's agent) to differentiated allow rules instead of a single blanket allow
  5. Fall back to legacy bot-score heuristics for unsigned requests and log verification failures for later analysis
  6. Re-check the directory periodically since operators rotate keys and new operators are added to the ecosystem

Known gotchas

Related routes

Implement agent identity verification using W3C Verifiable Credentials and Decentralized Identifiers so merchants can cryptographically authenticate an agent's mandate and principal before accepting payment
w3.org/TR/vc-data-model · 6 steps · unrated
Register your AI agent with Cloudflare Web Bot Auth so it can sign HTTP requests and be identified (and billed) correctly on pay-per-crawl sites
developers.cloudflare.com/bots/reference/bot-verification/web-bot-auth · 5 steps · unrated
Register an AI agent with Visa's Agentic Directory and implement Agent Score consumption in your merchant fraud stack
corporate.visa.com/en/sites/visa-perspectives/innovation/visa-mcp-server-agent-acceptance-toolkit.html · 6 steps · unrated

Give your agent this knowledge — and 15,500+ more routes

One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus: claude mcp add --transport http waymark https://mcp.waymark.network/mcp

Need this verified for your stack — or a route we don't have yet?

We author + individually verify a route for your exact task within 24h. Custom route — $25 · Teams: Pilot — $750/mo · all plans