Web Bot Auth: how agents prove who they are
The user-agent is just text. Web Bot Auth replaces the guesswork with a cryptographic signature, and Lume checks it on every request.
The spoofing problem
For decades, a bot has announced itself with a user-agent string, a line of text it chooses to send. Anyone can copy “Googlebot” or “GPTBot” into that field, so the string proves nothing. Measured spoof rates run into the double digits for popular AI crawlers.
How HTTP Message Signatures work
Web Bot Auth builds on HTTP Message Signatures (RFC 9421). The operator publishes an Ed25519 public key at a well-known location. Its bot signs each request with the matching private key, adding a signature header. A site can then verify the signature against the published key, proving the request came from the holder of that key, not an impostor with a copied user-agent.
Who signs today
Adoption is early but real: OpenAI and Anthropic publish Web Bot Auth keys that Lume checks today. The set grows as more operators adopt the standard, and Lume tracks it from the catalog, so a new signer shows up without a copy change.
How Lume verifies it: live, per request
Lume is standard-neutral and multi-signal. It verifies Web Bot Auth signatures where present, and falls back to forward-confirmed reverse DNS and published IP ranges everywhere else. One verdict per request. Lume isn’t a gatekeeper deciding who’s allowed on the web; it’s the mirror that tells you who’s authentic.
FAQ
Is Web Bot Auth the same as blocking bots?
No. Web Bot Auth is an identity standard. It lets a bot prove who it is. What you do with that proof (allow, log, rate-limit) is separate. Lume uses it to verify, not to block.
Does a valid signature mean a bot is trustworthy?
It means the bot is who it claims to be: a consistent, verifiable identity. Reputation is a separate layer. That’s why Lume combines signatures with reverse DNS and published IP ranges rather than trusting any single signal.
What about operators that don’t sign yet?
Most don’t, yet. Lume falls back to reverse DNS and published IP ranges for them, and labels anything it can’t verify honestly, never as “verified.”
See signed agents on your own site.
Lume verifies Web Bot Auth live. Free plan, set up in minutes.
Start for free →