---
name: web-bot-auth
title: Web Bot Auth
category: botAccessControl
---

# Web Bot Auth

Web Bot Auth lets a bot cryptographically sign its requests, so a receiving site can tell a legitimate agent from a scraper pretending to be one.

## When to use this skill

Use this when a site fails the "Web Bot Auth" check and you need to implement it.

## Goal

Let your site identify itself as a bot with Web Bot Auth

## Pass criteria

A JWKS is published at /.well-known/http-message-signatures-directory.

## Implementation

This skill covers the diagnosis. The step-by-step implementation prompt is part
of the paid tier and is served per scan by the API — see https://agent-ready.t0ols.com/llms-full.txt.

## Specifications

- https://datatracker.ietf.org/wg/webbotauth/about/
- https://developers.cloudflare.com/bots/reference/bot-verification/web-bot-auth/

## Verifying

Re-run the scan against the site and confirm the check reports a pass:

    curl -s https://agent-ready.t0ols.com/api/scan \
      -H 'content-type: application/json' \
      -d '{"url":"https://example.com","enabledChecks":["webBotAuth"]}'