VercatusOpenAI cloud browser signed requests
OpenAI's cloud-hosted browsing agent (ChatGPT agent, now called ChatGPT Work's Cloud browser in OpenAI's help centre) signs every outbound request with Web Bot Auth (RFC 9421 HTTP Message Signatures): each request carries Signature and Signature-Input headers and a Signature-Agent header set to "https://chatgpt.com", with public keys at https://chatgpt.com/.well-known/http-message-signatures-directory. Akamai and HUMAN list it as "ChatGPT Agent", Cloudflare as the signed agent with bot tag chatgpt-agent (detection ID 129220581), Vercel as chatgpt-operator, and these providers verify the signature themselves. OpenAI says that at launch the Cloud browser cannot sign in to websites or complete payments, and that proxies which strip the three signature headers cause legitimate requests to be blocked.
Sources
- 1
- 2Cloudflare · 2025Perplexity is using stealth, undeclared crawlers to evade website no-crawl directives (notes ChatGPT Agent signs requests with Web Bot Auth)blog.cloudflare.com
AGrade A: official documentation or a standard. A grade describes the provenance of the sources above; it is not a probability that a change will work. The effect basis says how the size of the effect is known: measured by a study, taken from an industry report, only documented without a size, or not quantified.
Put this evidence to work
Related entries
More in Access and crawlers, or search the whole base.
All Access and crawlers entries