Web Bot Auth Solves Identity. But Is That Enough?

Summary 

AI agents are rapidly becoming first-class participants on the open web, but today’s authentication and identity-verification mechanisms have limitations. At CHEQ, we believe agents deserve identity infrastructure to let them coexist with us on the web. A recent protocol, Web Bot Auth, has emerged as the leading open standard for agent identity. While it enables verification of an agent’s identity, is that enough to trust its intent? This blog explores the protocol, its growing adoption, and its limitations as the foundation for trusted agent interactions.

Background

As AI agents increasingly operate across the internet, businesses are struggling to identify the growing number of non-human visitors who have arrived on their websites. With fragmented methods used to identify, verify and legitimize these entities, the open web auth techniques that aim to protect the web can’t keep up. 

Recent protocols, open specifications, and standards are trying to answer one fundamental question: Is this interaction trustworthy?

The first large-scale protocol addressing this problem was introduced by Cloudflare in 2025: Web Bot Auth (WBA) aims to establish agent integrity and authenticity. While it represents a major step forward for agent identity on the web, businesses still need additional signals to assess an agent’s behavior, intent, and reliability.

Since the early launch of Web Bot Auth, CHEQ’s Agent Intent has upheld the standard of verifying agent identity, while combining additional trust signals to evaluate not just who the agent is, but whether its intent can be trusted.

What is Web Bot Auth?

Web Bot Auth is an open standard for AI agents and bots to cryptographically prove their identity over HTTP messages, serving as a foundational primitive for identity on the web.

The architecture is built on the IETF draft that later became official RFC 9421: HTTP Message Signatures, designed to provide a secure identity layer for non-human traffic.

The protocol flow is intuitive and involves three main participants:

• The operator – the source behind the agent. The operator is responsible for the agent and can be identified by its well-known directory (URL). For example, the operator for ChatGPT agent requests is OpenAI.
• The agent – the non-human entity. The agent interacts with services and performs actions.
• The verifier – the service. Its goal is to verify the legitimacy of the interaction. The verifier performs cryptographic verification using key pairs. The verifier, typically the service owner itself, uses this process to protect its business resources from unverified interactions.

How Web Bot Auth Protocol works 

Let’s dive deeper into how the protocol works behind the scenes.

The agent operator publishes a public-key directory, whose location is provided in the signature agent header. This header tells the verifier where the public keys live.

Before the agent makes a request to a service, it creates a signature with auth parameters carried in Signature-Input. The Signature header itself contains the actual cryptographic proof.

Then the verifier, an application or a service, retrieves the relevant public keys and performs the asymmetric cryptographic verification between the public and private keys, and determines whether the agent is verified.

Here’s an example of an interaction:

JSON

GET/path/to/resource HTTP/1.1

Host: www.example.com
User-Agent: Mozilla/5.0 Chrome/131.1.0 AI-Agent/1.0
Signature-Agent: signer.example.com
Signature-Input: sig=(“@authority” “signature-agent”);\

created=1800000000;\
expires=1800011111;\
keyid=“ba3e64==”;\
tag=“web-bot-auth”

Signature: sig=abc-

Recent Market Signals

Since Web Bot Auth was announced, the market has begun adopting the specification and signing real-world agents and bots. More recently, large companies have announced their support for the protocol as it has grown in popularity.

Some of the recent adoption updates include:

• Google – In June 2026, Google started using Web Bot Auth to identify its bots and crawlers using cryptographic signatures.

• Shopify announced in May 2026 that it signs bots and agents with the protocol and authenticates their requests so they qualify for higher rate limits and certain actions.

• OpenAI signs ChatGPT agent and agentic requests using the Web Bot Auth protocol. They declare their origin domain to legitimize traffic from agents acting on behalf of humans.

• Amazon – Amazon recently added protocol support to Bedrock AgentCore Browser, enabling dedicated signatures for agentic interactions across several products.

We see high adoption across use cases of classic bots, such as crawlers for search, training, or fetching purposes, while adoption for consumer AI agents acting on behalf of end-users is less established and still immature.

Related Agentic Protocols 

Since its introduction, similar purpose-built solutions have been announced using the same cryptographic capabilities to extend open web identity and trust across more domains.

Trusted Agent Protocol (TAP)

Visa’s protocol allows merchants to control and distinguish trusted, commerce-focused agents from generic bots.

TAP focuses on commerce and payments, as Visa signs agents with registered signatures that prove authenticity for two main purposes: browsing the web (Browse-mode) and letting agents make payments (Payment-mode). 

Universal Commerce Protocol (UCP)

UCP is an open standard developed by Google that standardizes how AI agents interact with businesses to enable commerce.

The protocol uses the same underlying cryptographic primitives and RFC 9421 specification. What differs is the discovery path: UCP uses UCP-agent as its signer-profile, rather than signature agent used by Web Bot Auth.

Platforms discover business profiles through /.well-known/ucp, while businesses discover platform profiles through the UCP-agent header.

Where Web Bot Auth falls short

Growing volume and popularity are establishing the protocol as an open-web-scale protocol, yet despite those signals, the protocol alone does not make the web trustworthy, and some fundamental gaps remain unsolved.

• • Unknown Operators – Any domain can act as its own verification authority. Any hosting provider can sign agents and bots with its own keys. Fraudsters can use the same mechanism to self-verify and gain trust for their identity.
  • Authentication without Authorization – The spec asks “who is this,” but determines nothing about permitted purpose, data retention, and rate limits.
  • Limited Operator/Agent Context – Cryptographic verification proves control of a key, but does not provide additional context about the entity behind it, the source, interaction purpose, intent, or limits.
  • Delegation is Unmodeled – The key identifies the vendor, not the owner. When end-users or principals are involved, the protocol does not identify on whose behalf the agent is acting.

Next Steps

At CHEQ, we believe that identity infrastructure for AI agents on the open web is essential.  The Web Bot Auth specification standardizes identity verification and helps turn unknown automated interactions into accountable journeys. Despite the limitations described above, we see that adoption is moving fast, already governing a growing share of open-web traffic.

CHEQ’s product suite, including Agent Intent, supports Web Bot Auth verification alongside other protocols. We treat these protocols as trust signals within a broader assessment, combining it with additional signals such as intent, behavior, and risk to evaluate the agent’s trustworthiness. This layered approach offers a promising way for legitimising non-human identities and their interactions, helping make our web more reliable and safe.

AI agent authentication and verification are still at an early stage; more work is underway, and we expect a broader ecosystem of protocols and specifications to emerge as the open web continues its transition toward an agentic future.