Authenticated identity for web bots

Web Bot Auth lets an automated client prove its identity by signing requests with HTTP Message Signatures (RFC 9421). Signature-Input carries tag="web-bot-auth", created and expires timestamps and a key id, the signature covers at least @authority or @target-uri, and a Signature-Agent header points to a JWKS key directory at /.well-known/http-message-signatures-directory. The signature identifies the client, not the page content. The IETF chartered the Web Bot Auth working group on 23 October 2025. Its protocol draft is draft-ietf-webbotauth-httpsig-protocol (-00 of 1 September 2026, authors from Cloudflare and Google), which replaces draft-meunier-web-bot-auth-architecture. The documented signers are agents. Google signs a subset of Google-Agent requests as https://agent.bot.goog, experimentally, and documents no signing for Googlebot. OpenAI's Cloud browser, which CDNs list as ChatGPT Agent, signs with Signature-Agent "https://chatgpt.com", and Cloudflare, Akamai, HUMAN and Vercel verify those signatures.