AgentDrives
For ownersFree check

Signed agents: the agents a bot check knows.

A bot-check vendor keeps a list of agents that sign their requests and that it has checked. A site can let those through and still stop anonymous bots.

The numbers

From our drives of 151 products, 1–24 Oct 2026. Each one links to its definition and evidence.

  1. Let a known signed agent past their edge check10 of 13
  2. Opened sign-up to a known signed agent112 of 131

AgentDrivesUpdated 24 October 2026For agents MarkdownData JSON

What it is

An agent signs its requests with Web Bot Auth. A vendor then verifies the operator and adds it to its list. On Cloudflare an operator applies through the Bot Submission Form, with Request Signature as the way to verify it.1

Since 1 July 2026 Cloudflare counts signed agents as verified bots.2 Its default bot settings leave verified bots alone on every plan.2 HUMAN gives an agent that signs every request a high trust level.3

What a known signed agent met

For each product we also fetch its sign-up page as a signed agent Cloudflare already knows, and compare it with an agent on a server.

The sign-up page opened for that signed agent at 112 of 131 products where we fetched it.

The difference shows where a check stood at the edge: 10 of 13 products that stopped agents on a server before the sign-up page opened it for the known signed agent.

Signed, not verified: during these drives no bot-check provider listed our agent as a verified bot, so a check could see the signature but had no verified identity to trust.

How to let them in

  1. Leave verified bots out of your own block rules.

    On Cloudflare, add the verified-bot field to each custom rule on sign-up, login and the key page: cf.bot_management.verified_bot (boolean)4.

    (your rule's expression) and not cf.bot_management.verified_bot

  2. Check your AI bot policy.

    New Cloudflare domains since 15 September 2026 block agents on pages that show ads.5 Allow them on the pages where they sign up.

  3. Do the same on your other vendors.

    The bot-check guide has the setting for Vercel, Akamai, DataDome, HUMAN and AWS WAF.

Check it yourself

  1. Read your security events.

    Look for requests on your sign-up page from verified bots. A block or a challenge there is a rule to change.

  2. See it on your product's page.

    Each product page here shows who gets in: an agent on a server, a known signed agent and an agent in a browser.

Products that stopped agents at the edge and let a known signed agent in.

10 products we drove, by name. Each row is the product's newest drive.

  • beehiivEmail marketing
    Can't sign up on its own: a bot check stops it    L1Needs a personDriven 6 Oct 2026
  • CanvaDesign
    Can't sign up on its own: a bot check stops it    L1Needs a personDriven 16 Oct 2026
  • FreshdeskCustomer support
    Can't sign up on its own: a bot check stops it    L1Needs a personDriven 6 Oct 2026
  • JotformForms
    Can't sign up on its own: a bot check stops it    L1Needs a personDriven 19 Oct 2026
  • KitEmail marketing
    Can't sign up on its own: a bot check stops it    L1Needs a personDriven 6 Oct 2026
  • LaterSocial media scheduling
    Can't sign up on its own: a bot check stops it    L0Read-onlyDriven 6 Oct 2026
  • MakeAutomation
    Can't sign up on its own: a bot check stops it    L1Needs a personDriven 6 Oct 2026
  • MemosDocs and workspace
    Can't sign up on its own: a bot check stops it    L1Needs a personDriven 23 Oct 2026
The other 2 products
  • MolliePayments
    Can't sign up on its own: a bot check stops it    L1Needs a personDriven 17 Oct 2026
  • SalesforceCRM
    Can't sign up on its own: a bot check stops it    L1Needs a personDriven 16 Oct 2026

Check if this stops agents in your product.

Free: what an agent finds in your product, and any wall in its way.

Pages this reference cites.

As linked when it was written. ↩ goes back to where the text cites it.

  1. 1developers.cloudflare.com · Cloudflare docsbots/reference/bot-verification/web-bot-auth↩
  2. 2developers.cloudflare.com · Verified botsbots/concepts/bot/verified-bots↩
  3. 3docs.humansecurity.com · About agent trust levelsapplications/about-agent-trust-levels↩
  4. 4developers.cloudflare.com · Bot Management variablesbots/reference/bot-management-variables↩
  5. 5developers.cloudflare.com · Block AI botsbots/additional-configurations/block-ai-bots↩

Asked about this reference.

Can any agent get on the list?

An operator applies to each vendor. The vendor decides, and its list differs from the next vendor's.

Do I have to let signed agents in?

No. You decide. Letting them in on sign-up is what lets an agent become your customer on its own.

Cite this

AgentDrives. “Signed agents: which products let known AI agents through.” 24 October 2026. agentdrives.com/standards/signed-agents

Drive data is CC BY 4.0. The text as Markdown. Every fact with its evidence.

More from the drives.

Fix guideLet signed agents past your bot checkThe fix in steps, with a check you can run yourself.Read StandardWeb Bot AuthAn agent signs each request; a site's bot check can verify who sent it.Read StandardMCPA server that turns a product's actions into tools an agent can call.Read