How to verify an AI agent is who it says it is

A user agent header is a claim, not proof of identity. Learn when published IP ranges are useful, how Web Bot Auth verifies signed requests, and why a verified agent still needs permission to perform sensitive actions.

Reviewed October 1, 2026 · 8 min read

To verify an AI agent, use the method its operator supports: a published IP range, validated DNS procedure or a cryptographic request signature. Matching a user agent string alone is not enough, because any client can copy that header.

Different products from the same company can use different verification methods. OpenAI publishes IP information for several crawlers, while its Cloud browser allowlisting guide describes signed requests. Identify the product before copying an allowlist rule.

Verification helps you apply access rules to the right caller. It does not prove that the customer authorized a purchase, that a request is harmless, or that the caller should see private records. Those decisions still belong to your application.

What each verification method can tell you#

Use an operator’s documented method and keep its configuration current. These signals have different strengths and limits:

An IP check remains useful where the provider supports it. Behind a proxy, obtain the client address from trusted infrastructure rather than an arbitrary forwarded header. When the provider uses signatures, follow that integration instead of inventing a static range.

How Web Bot Auth signs an agent request#

Web Bot Auth builds on HTTP Message Signatures. OpenAI’s documented Cloud browser integration uses three headers:

• Signature contains the cryptographic signature.
• Signature-Input describes the covered components and signature parameters.
• Signature-Agent identifies the claimed operator; OpenAI documents https://chatgpt.com for its Cloud browser.

Your verifier must check the complete supported profile, including which request components are signed and how timestamps, keys and algorithms are validated. A signature that covers only the destination host does not bind every method, path or body sent to that host.

Find the operator’s public key directory#

Cloudflare’s Web Bot Auth documentation describes publishing a public key directory over HTTPS at a well-known path. Its integration also requires a signed directory response. Use the provider’s supported validation procedure, including directory binding and key rotation, rather than just downloading a key and checking some bytes.

OpenAI publishes a directory you can inspect with this read-only request:

curl -fsS https://chatgpt.com/.well-known/http-message-signatures-directory

# Public keys verify signatures.
# The operator keeps the corresponding private signing keys.

This command lets you inspect the directory; it does not verify an incoming request. If you build a verifier, do not fetch arbitrary caller-supplied URLs without safeguards. Restrict directory retrieval, validate HTTPS and redirects, and prevent requests to private network addresses.

What an agent card adds#

The proposed signature agent card adds operator metadata, such as identity, purpose and expected behavior. The registry and card draft is separate from the request-signature protocol. Treat its fields as versioned declarations, not as a universal capability every agent already provides.

Metadata can make an access policy easier to maintain. It does not enforce the policy for you. Keep a record of the operator’s declared behavior, the version you support and what your own logs show.

Match access to the purpose of the request#

A training crawler, search indexer and user-requested browser serve different purposes. Decide which activities your site permits, then apply that decision using verified identity and provider-supported controls where available.

For a public catalog, allowing a recognized search or user-requested client may help people find your offers. For account details or order changes, require the normal customer authorization. Which AI crawlers to allow explains the policy choices and current operator distinctions.

A practical verification checklist#

Start with your CDN or security provider’s integration. If you maintain verification yourself, assign an owner for protocol updates, key rotation and failure handling.

1. Identify the exact agent product and read its official allowlisting instructions. Do not assume a crawler and a browser agent share a verification method.
2. Use your provider’s verified identity or detection identifier, with the narrowest rule needed. Bot names differ between providers.
3. Inspect edge logs before changing robots.txt. A firewall challenge or block can stop a request before your application sees it.
4. Test valid, expired and invalid signatures, an unknown key, a changed request and a directory outage. Log the decision without exposing credentials.
5. Review existing IP rules and key caches for freshness. Preserve supported controls that still serve a purpose, and remove stale or overly broad exceptions.

Standards status and replay limits#

As of October 1, 2026, the IETF Web Bot Auth working group has an HTTP signature protocol draft. The underlying HTTP Message Signatures specification is RFC 9421; the bot-specific work is still developing. Deployed provider integrations may differ from the newest draft.

Expiration limits how long a captured signature can be reused, but does not necessarily make it single-use. The current draft explicitly discusses signatures that remain reusable against the same host. Sensitive actions need the appropriate request binding, customer authorization and duplicate-action protection in addition to bot verification.

Verification also cannot guarantee good behavior. Keep rate limits and abuse controls appropriate to the endpoint. A known operator can still send a request your application should reject.

Once access is correct, check what legitimate callers receive: accurate catalog data, a consistent business identity and a clear next step. Verification makes it possible to recognize the caller; useful content and authorized actions make the visit worthwhile.