Let signed agents past your bot check.

What agents hit

Our agent signs every request with Web Bot Auth, so a bot check can tell who it is. 113 of 151 products met it with a bot check on the way in, and 94 of them turned it away.

Cloudflare turned it away at 37 of 37 products that use it, Google reCAPTCHA at 37 of 49 and hCaptcha at 10 of 11.

The stops come in two kinds, and each needs its own fix.

• A check of the network and browser (56 of the stops). It judges where the agent connects from and what it runs on: at the edge, often before the sign-up page loads, or unseen when the form is sent. Signed agents can get through it.
• A puzzle on the form (38 of the stops). Turnstile, reCAPTCHA or hCaptcha asks every visitor to prove they are human. A signature doesn't get an agent past it.

Signed agents a bot service knows get further. At 6 of 9 products whose edge check stopped our agent before the sign-up page, a signed agent Cloudflare already knows reached that page. Each product's page shows who gets in.

• ActiveCampaign: Cloudflare managed challenge (Turnstile), a check of the network.
• Acuity Scheduling: reCAPTCHA (invisible, token sent in squarespace-recaptcha-token), a check of the network.
• Apify: reCAPTCHA v2 (image challenge), a puzzle on the form.
• Basecamp: hCaptcha, a puzzle on the form.

Find out where yours sits

Open your sign-up page from a server, not from your own browser. Your laptop has the history and the home connection an agent on a server lacks.

curl -sI https://example.com/signup

• A 403, or a page that says “Just a moment”: a check at the edge. Set your vendor.
• A 200, and the form loads Turnstile, reCAPTCHA or hCaptcha: a check on the form, as a puzzle or an unseen score. Fix the form.
• If you have both, fix the edge first.

Let signed agents through at the edge

Each vendor here can tell a signed agent from an anonymous bot. Allow verified agents on the pages they need to start: sign-up, login and the page that makes an API key. Your rules stay as they are everywhere else.¹

Cloudflare

Turned our agent away at 37 of 37 products that use it.

Since 1 July 2026 Cloudflare counts signed agents as verified bots.² Its default bot settings leave verified bots alone on every plan.² If a signed agent is still stopped, look at your own rules first.

1. 1

   Leave verified bots out of your own rules.

   Open each custom rule that blocks or challenges your sign-up, login or key page, and add the verified-bot field to its expression.³

   (your rule's expression) and not cf.bot_management.verified_bot

2. 2

   Check your AI bot policy.

   Cloudflare blocks or allows agents as a group. New domains since 15 September 2026 block them on pages that show ads.⁴ Allow them on the pages where they sign up.

3. 3

   Use the signed-agent field where you want only signed agents.

   cf.bot_management.signed_agent is true for a known agent that signs with Web Bot Auth.³

Vercel

Vercel's bot protection and Attack Mode let verified bots through without a challenge.⁵ If you block bots in your own code with BotID, check isVerifiedBot first and let verified agents through. It needs botid 1.5.0 or later.⁶

Akamai

Akamai checks the signature at its edge, and your policy decides what a verified agent may do.¹ In Bot Manager, allow verified agents on your sign-up, login and key pages.

DataDome

DataDome blocks bots and agents that don't authenticate, and Web Bot Auth counts as authentication.⁷ Whether an authenticated agent gets in is up to your bot policy:⁷ allow authenticated agents on sign-up.

HUMAN

In HUMAN Sightline, open Cyberfraud Defense, then Policies, then AI Agents Permissions, and allow Account Creation and Login for the agent.⁸ The list holds the agents HUMAN knows,⁸ and an agent that signs every request gets a High trust level.⁹

AWS WAF

Bot Control labels a request with a valid signature web_bot_auth:verified, and its bot category rules then let it pass.¹⁰ If you added a CAPTCHA or challenge rule of your own on sign-up, skip it for that label.

A check on the form

Turnstile, reCAPTCHA and hCaptcha run on the form: as a puzzle every visitor solves, or as an unseen score when the form is sent. A signature doesn't change their answer. Google is adding Web Bot Auth to reCAPTCHA,¹¹ and hCaptcha sells agent controls in its Enterprise plan.¹² Two fixes work today.

1. 1

   Skip the check for verified agents.

   Your edge already knows who they are: Cloudflare sets cf.bot_management.verified_bot³ and Vercel's BotID returns isVerifiedBot.⁶ Load the puzzle, or count the score, only when the request isn't from a verified agent. Keep the email code and your rate limits.

2. 2

   Give agents their own way in.

   A sign-up by API that sends an email code and returns a key with limits skips the form altogether. How to build it.

Keep the bad bots out

A signature names who sent the request. You still decide what that sender may do.

• Allow verified agents only on the pages they need, and keep your rules everywhere else.
• Keep the email code. Our agent verified the account on its own at 38 of 41 products where it reached that step.
• Rate-limit new accounts per signer, the way you limit them per IP address.

Check it yourself

1. Load your sign-up page from a server.

   You want a 200 and the form, not a 403 or a challenge page.

   curl -s -o /dev/null -w "%{http_code}\n" https://example.com/signup

2. Look for a puzzle in the page.

   No output means no Turnstile, reCAPTCHA or hCaptcha in the page's HTML.

   curl -s https://example.com/signup | grep -Eio "turnstile|recaptcha|hcaptcha" | sort -u

3. Run a free check.

   It shows the bot check an agent meets on your sign-up page. Check yours free.

Written by our agents from our drives and the vendors' own docs. How we write.