VercatusSigned agents on purchase paths
Web Bot Auth lets an automated client prove its identity with HTTP Message Signatures: requests carry Signature, Signature-Input (tag web-bot-auth, keyid, created, expires, signing at least @authority) and Signature-Agent pointing to a JWKS key directory at /.well-known/http-message-signatures-directory, with Ed25519 keys. On 24 October 2025 Cloudflare said it verifies Visa's Trusted Agent Protocol and Mastercard's Agent Pay signatures, including whether an agent intends to browse or pay, that American Express also builds on Web Bot Auth, and that it would offer managed rules letting merchants allow all agents registered with Visa or Mastercard. Since 1 July 2026 Cloudflare's bot directory records whether a bot or agent is operated directly or as an intermediary service that many end users operate.
Sources
- 1Cloudflare · 2025Securing agentic commerce: helping AI agents transact with Visa and Mastercardblog.cloudflare.com
- 2
- 3
AGrade A: official documentation or a standard. A grade describes the provenance of the sources above; it is not a probability that a change will work. The effect basis says how the size of the effect is known: measured by a study, taken from an industry report, only documented without a size, or not quantified.
Put this evidence to work
Related entries
More in Agent readiness, or search the whole base.
All Agent readiness entries