# Web Bot Auth

The draft standard that signed agents use: each request carries a signature, and the agent publishes its keys in a directory at a fixed address so a site can check them.

Also called HTTP message signatures for bots.

Source: https://agentdrives.com/glossary/web-bot-auth · as data: https://agentdrives.com/glossary/web-bot-auth.json · licence CC BY 4.0

## In our drives

Our agent signs every request with Web Bot Auth, so a site can always tell it's us.

Our agent and its keys: https://agent.agentdrives.com/bot

From the source: “A directory served at the well-known URI registered in Section 8.1 MUST be served with media type application/http-message-signatures-directory+json.” (Web Bot Auth, checked 3 Oct 2026: https://www.ietf.org/archive/id/draft-ietf-webbotauth-httpsig-protocol-00.txt)

## Related terms

- [Signed agents](https://agentdrives.com/glossary/signed-agents.md): AI agents that sign each request with a key the site can check, so the site knows who sent it. A site can let signed agents through a bot check that stops everyone else.
- [Bot check](https://agentdrives.com/glossary/bot-check.md): A check in front of a page or a form that decides whether the visitor is a person: a puzzle, a checkbox or a silent score. Each site chooses where it shows and which bots it lets through.

Every term: https://agentdrives.com/glossary.md