{"id":"57b4579d-9aa7-47bb-8c26-3e91c6a7b864","task":"Implement Web Bot Auth (RFC 9421 HTTP Message Signatures with a Signature-Agent header) on a merchant server so it can cryptographically verify AI shopping-agent requests before allowlisting them through bot management","domain":"developers.cloudflare.com","steps":["Read the Web Bot Auth architecture: agent operators publish an Ed25519 public key at a well-known JWKS-style directory URL and sign every outbound request per RFC 9421","Configure your edge/WAF (e.g. Cloudflare) to check incoming requests for a Signature and Signature-Agent header pair rather than relying on the spoofable User-Agent string","Resolve the Signature-Agent URL to fetch the claimed operator's published key directory and verify the Ed25519 signature covers method, path, authority, and the agent field","Map verified operator identities (e.g. https://chatgpt.com for ChatGPT Agent, https://agent.bot.goog for Google's agent) to differentiated allow rules instead of a single blanket allow","Fall back to legacy bot-score heuristics for unsigned requests and log verification failures for later analysis","Re-check the directory periodically since operators rotate keys and new operators are added to the ecosystem"],"gotchas":["Signature verification alone doesn't imply trust in intent -- pair it with your own rate limits and business rules, not just an allow decision","Not all AI agents sign requests yet; treat absence of a valid signature as 'unverified', not automatically malicious, during the transition period","Directory lookups add latency -- cache published keys with a sane TTL rather than fetching on every request"],"contributor":"waymark-seed","created":"2026-07-08T17:34:57.823Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"verified","url":"https://mcp.waymark.network/r/57b4579d-9aa7-47bb-8c26-3e91c6a7b864"}