# Let signed AI agents past your bot check 75 of 93 products whose bot check met our signed agent turned it away. The setting that lets signed agents in, per vendor, and how to check yours. Source: https://agentdrives.com/fixes/let-signed-agents-past-your-bot-check · Updated 2026-10-12 · Wall: Bot check An agent that signs its requests can tell your bot check who it is. Edge checks can then let it in with one setting. A puzzle on the form needs its own fix. ## The numbers From the drives of 140 products, 1–16 Oct 2026 (https://agentdrives.com/data/facts?via=md): - Products whose bot check stopped our signed agent: 75 of 93 - Of those stops: a check of the network and browser, which signed agents can pass: 48 of 75 - Of those stops: a puzzle on the form, which a signature doesn't pass: 27 of 75 ## What agents hit Our agent signs every request with Web Bot Auth, so a bot check can tell who it is. 93 of 140 products met it with a bot check on the way in, and 75 of them turned it away. Cloudflare hasn't added our agent to its list of signed agents yet. Cloudflare turned it away at 27 of 27 products that use it, Google reCAPTCHA at 35 of 45 and hCaptcha at 7 of 8. The stops come in two kinds, and each needs its own fix. - **A check of the network and browser** (48 of the stops). It judges where the agent connects from and what it runs on: at the edge, often before the sign-up page loads, or unseen when the form is sent. Signed agents can get through it. - **A puzzle on the form** (27 of the stops). Turnstile, reCAPTCHA or hCaptcha asks every visitor to prove they are human. A signature doesn't get an agent past it. Signed agents a bot service knows get further. At 7 of 10 products whose edge check stopped our agent before the sign-up page, a signed agent Cloudflare already knows reached that page. Each product's page shows [who gets in](https://agentdrives.com/method?via=md#who-gets-in). - [ActiveCampaign](https://agentdrives.com/tools/activecampaign?via=md): Cloudflare managed challenge (Turnstile), a check of the network. - [Acuity Scheduling](https://agentdrives.com/tools/acuityscheduling?via=md): reCAPTCHA Enterprise (invisible) on Squarespace login, a check of the network. - [Backblaze B2](https://agentdrives.com/tools/backblaze?via=md): Google reCAPTCHA v2 checkbox (on Backblaze's own 'Security Check' page; reCAPTCHA Enterprise script on the form), a puzzle on the form. - [Box](https://agentdrives.com/tools/box?via=md): hCaptcha, a puzzle on the form. ## Find out where yours sits Open your sign-up page from a server, not from your own browser. Your laptop has the history and the home connection an agent on a server lacks. ``` curl -sI https://example.com/signup ``` - A 403, or a page that says “Just a moment”: a check at the edge. [Set your vendor](#edge). - A 200, and the form loads Turnstile, reCAPTCHA or hCaptcha: a check on the form, as a puzzle or an unseen score. [Fix the form](#form). - If you have both, fix the edge first. ## Let signed agents through at the edge Each vendor here can tell a signed agent from an anonymous bot. Allow verified agents on the pages they need to start: sign-up, login and the page that makes an API key. Your rules stay as they are everywhere else. [1] ### Cloudflare Turned our agent away at 27 of 27 products that use it. Since 1 July 2026 Cloudflare counts signed agents as verified bots. [2] Its default bot settings leave verified bots alone on every plan. [2] If a signed agent is still stopped, look at your own rules first. 1. **Leave verified bots out of your own rules.** Open each custom rule that blocks or challenges your sign-up, login or key page, and add the verified-bot field to its expression. [3] ``` (your rule's expression) and not cf.bot_management.verified_bot ``` 2. **Check your AI bot policy.** Cloudflare blocks or allows agents as a group. New domains since 15 September 2026 block them on pages that show ads. [4] Allow them on the pages where they sign up. 3. **Use the signed-agent field where you want only signed agents.** `cf.bot_management.signed_agent` is true for a known agent that signs with Web Bot Auth. [3] ### Vercel Vercel's bot protection and Attack Mode let verified bots through without a challenge. [5] If you block bots in your own code with BotID, check `isVerifiedBot` first and let verified agents through. It needs botid 1.5.0 or later. [6] ### Akamai Akamai checks the signature at its edge, and your policy decides what a verified agent may do. [1] In Bot Manager, allow verified agents on your sign-up, login and key pages. ### DataDome DataDome blocks bots and agents that don't authenticate, and Web Bot Auth counts as authentication. [7] Whether an authenticated agent gets in is up to your bot policy: [7] allow authenticated agents on sign-up. ### HUMAN In HUMAN Sightline, open Cyberfraud Defense, then Policies, then AI Agents Permissions, and allow Account Creation and Login for the agent. [8] The list holds the agents HUMAN knows, [8] and an agent that signs every request gets a High trust level. [9] ### AWS WAF Bot Control labels a request with a valid signature `web_bot_auth:verified`, and its bot category rules then let it pass. [10] If you added a CAPTCHA or challenge rule of your own on sign-up, skip it for that label. ## A check on the form Turnstile, reCAPTCHA and hCaptcha run on the form: as a puzzle every visitor solves, or as an unseen score when the form is sent. A signature doesn't change their answer. Google is adding Web Bot Auth to reCAPTCHA, [11] and hCaptcha sells agent controls in its Enterprise plan. [12] Two fixes work today. 1. **Skip the check for verified agents.** Your edge already knows who they are: Cloudflare sets `cf.bot_management.verified_bot` [3] and Vercel's BotID returns `isVerifiedBot`. [6] Load the puzzle, or count the score, only when the request isn't from a verified agent. Keep the email code and your rate limits. 2. **Give agents their own way in.** A sign-up by API that sends an email code and returns a key with limits skips the form altogether. [How to build it](https://agentdrives.com/fixes/let-agents-sign-up-and-get-a-key). ## Keep the bad bots out A signature names who sent the request. You still decide what that sender may do. - Allow verified agents only on the pages they need, and keep your rules everywhere else. - Keep the email code. Our agent verified the account on its own at 41 of 45 products where it reached that step. - Rate-limit new accounts per signer, the way you limit them per IP address. ## Check it yourself 1. **Load your sign-up page from a server.** You want a 200 and the form, not a 403 or a challenge page. ``` curl -s -o /dev/null -w "%{http_code}\n" https://example.com/signup ``` 2. **Look for a puzzle in the page.** No output means no Turnstile, reCAPTCHA or hCaptcha in the page's HTML. ``` curl -s https://example.com/signup | grep -Eio "turnstile|recaptcha|hcaptcha" | sort -u ``` 3. **Run a free check.** It shows the bot check an agent meets on your sign-up page, in minutes. [Check yours free](https://agentdrives.com/scan?via=md). ## After the fix Fixed something? Order a Drive ($49) any time, or the Monthly drive ($29/month). ## Questions **Do I let every bot in if I allow signed agents?** No. Anonymous bots still meet your rules. A signed agent names the operator behind it, and you choose the pages it may use. **Does your agent count as a verified bot?** Signed, not verified: during these drives no bot-check provider listed our agent as a verified bot, so a check could see the signature but had no verified identity to trust. **Should I turn off the CAPTCHA?** No. Keep it for anonymous visitors and skip it for verified agents, or give agents a sign-up by API. ## Sources 1. [Web Bot Auth in AgentCore Browser](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/browser-web-bot-auth.html) 2. [Verified bots](https://developers.cloudflare.com/bots/concepts/bot/verified-bots/) 3. [Bot Management variables](https://developers.cloudflare.com/bots/reference/bot-management-variables/) 4. [Block AI bots](https://developers.cloudflare.com/bots/additional-configurations/block-ai-bots/) 5. [Bot Management](https://vercel.com/docs/bot-management) 6. [BotID: verified bots](https://vercel.com/docs/botid/verified-bots) 7. [Bot authentication](https://docs.datadome.co/docs/bot-authentication) 8. [Manage AI agent permissions](https://docs.humansecurity.com/applications/manage-ai-agent-permissions) 9. [About agent trust levels](https://docs.humansecurity.com/applications/about-agent-trust-levels) 10. [Bot Control rule group](https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-bot.html) 11. [Introducing Google Cloud Fraud Defense](https://cloud.google.com/blog/products/identity-security/introducing-google-cloud-fraud-defense-the-next-evolution-of-recaptcha) 12. [hCaptcha against bots and agents in 2026](https://www.hcaptcha.com/blog/hcaptcha-captchas-are-highly-effective-against-bots-and-agents-in-2026) ## More fixes - [Let AI agents sign up and get an API key](https://agentdrives.com/fixes/let-agents-sign-up-and-get-a-key.md): An API call that signs up and returns a limited key, and a claim step for the person. - [MCP sign-in an AI agent can finish: OAuth and CIMD](https://agentdrives.com/fixes/mcp-sign-in-agents-can-finish.md): OAuth metadata, CIMD or DCR, and a way to approve without a browser on the agent's side. - [Let AI agents start without a credit card](https://agentdrives.com/fixes/card-free-starts.md): A free plan or a trial without a card, an API key that works on it, and limits instead of a card. - [Let AI agents pay you per call: x402 and MPP](https://agentdrives.com/fixes/let-agents-pay-per-call.md): x402 or MPP on a paid endpoint, your prices where agents read them, and plans an agent can buy by API or MCP. - [Docs AI agents can read: llms.txt, Markdown, OpenAPI](https://agentdrives.com/fixes/docs-agents-can-read.md): An llms.txt, Markdown twins of your pages, an OpenAPI spec and an MCP server card.