# Signed agents: which products let known AI agents through

At 10 of 13 products that stopped agents before sign-up, a signed agent Cloudflare knows got in. What signed agents are and how to let them in.

Source: https://agentdrives.com/standards/signed-agents · Updated 2026-10-24 · as data: https://agentdrives.com/standards/signed-agents.json · licence CC BY 4.0

A bot-check vendor keeps a list of agents that sign their requests and that it has checked. A site can let those through and still stop anonymous bots.

## The numbers

From our drives of 151 products, 1–24 Oct 2026 (https://agentdrives.com/data/facts?via=md):

- Let a known signed agent past their edge check: 10 of 13 (https://agentdrives.com/data/facts?via=md#who.edge_signed_page)
- Opened sign-up to a known signed agent: 112 of 131 (https://agentdrives.com/data/facts?via=md#who.signed_page)

## What it is

An agent signs its requests with [Web Bot Auth](https://agentdrives.com/standards/web-bot-auth). A vendor then verifies the operator and adds it to its list. On Cloudflare an operator applies through the Bot Submission Form, with Request Signature as the way to verify it. [1]

Since 1 July 2026 Cloudflare counts signed agents as verified bots. [2] Its default bot settings leave verified bots alone on every plan. [2] HUMAN gives an agent that signs every request a high trust level. [3]

## What a known signed agent met

For each product we also fetch its sign-up page as a signed agent Cloudflare already knows, and compare it with an agent on a server.

The sign-up page opened for that signed agent at 112 of 131 products where we fetched it.

The difference shows where a check stood at the edge: 10 of 13 products that stopped agents on a server before the sign-up page opened it for the known signed agent.

Signed, not verified: during these drives no bot-check provider listed our agent as a verified bot, so a check could see the signature but had no verified identity to trust.

## How to let them in

1. **Leave verified bots out of your own block rules.** On Cloudflare, add the verified-bot field to each custom rule on sign-up, login and the key page: `cf.bot_management.verified_bot (boolean)` [4].

   ```
   (your rule's expression) and not cf.bot_management.verified_bot
   ```

2. **Check your AI bot policy.** New Cloudflare domains since 15 September 2026 block agents on pages that show ads. [5] Allow them on the pages where they sign up.

3. **Do the same on your other vendors.** [The bot-check guide](https://agentdrives.com/fixes/let-signed-agents-past-your-bot-check) has the setting for Vercel, Akamai, DataDome, HUMAN and AWS WAF.

## Check it yourself

1. **Read your security events.** Look for requests on your sign-up page from verified bots. A block or a challenge there is a rule to change.

2. **See it on your product's page.** Each product page here shows who gets in: an agent on a server, a known signed agent and an agent in a browser.

## Products that stopped agents at the edge and let a known signed agent in

- [beehiiv](https://agentdrives.com/tools/beehiiv.md?via=md): L1 Needs a person
- [Canva](https://agentdrives.com/tools/canva.md?via=md): L1 Needs a person
- [Freshdesk](https://agentdrives.com/tools/freshdesk.md?via=md): L1 Needs a person
- [Jotform](https://agentdrives.com/tools/jotform.md?via=md): L1 Needs a person
- [Kit](https://agentdrives.com/tools/kit.md?via=md): L1 Needs a person
- [Later](https://agentdrives.com/tools/later.md?via=md): L0 Read-only
- [Make](https://agentdrives.com/tools/make.md?via=md): L1 Needs a person
- [Memos](https://agentdrives.com/tools/usememos.md?via=md): L1 Needs a person
- [Mollie](https://agentdrives.com/tools/mollie.md?via=md): L1 Needs a person
- [Salesforce](https://agentdrives.com/tools/salesforce.md?via=md): L1 Needs a person

## Questions

**Can any agent get on the list?**

An operator applies to each vendor. The vendor decides, and its list differs from the next vendor's.

**Do I have to let signed agents in?**

No. You decide. Letting them in on sign-up is what lets an agent become your customer on its own.

## Sources

1. [Cloudflare docs](https://developers.cloudflare.com/bots/reference/bot-verification/web-bot-auth/)
2. [Verified bots](https://developers.cloudflare.com/bots/concepts/bot/verified-bots/)
3. [About agent trust levels](https://docs.humansecurity.com/applications/about-agent-trust-levels)
4. [Bot Management variables](https://developers.cloudflare.com/bots/reference/bot-management-variables/)
5. [Block AI bots](https://developers.cloudflare.com/bots/additional-configurations/block-ai-bots/)

## More standards

- [MCP](https://agentdrives.com/standards/mcp.md): A server that turns a product's actions into tools an agent can call.
- [llms.txt](https://agentdrives.com/standards/llms-txt.md): A Markdown map of a product's docs, written for language models.
- [OpenAPI](https://agentdrives.com/standards/openapi.md): A machine-readable description of every route of an API.
- [Web Bot Auth](https://agentdrives.com/standards/web-bot-auth.md): An agent signs each request; a site's bot check can verify who sent it.
- [robots.txt for AI agents](https://agentdrives.com/standards/robots-txt-ai.md): The file that tells crawlers and agents which pages to leave alone.
- [x402](https://agentdrives.com/standards/x402.md): A 402 answer an agent pays in a stablecoin, request by request.
- [MPP](https://agentdrives.com/standards/mpp.md): A 402 payment challenge an agent pays by card or stablecoin.