---
title: "Web Bot Auth | web bot auth JWKS http message signatures | Agent-Ready Check"
description: "Web Bot Auth lets a bot cryptographically sign its requests, so a receiving site can tell a legitimate agent from a scraper pretending to be one. Pass criteria: A JWKS is published at /.well-known/http-message-signatures-directory."
locale: en
canonical: https://agent-ready.t0ols.com/checks/web-bot-auth/
---

# Web Bot Auth

> Category: Bot Access Control

Web Bot Auth lets a bot cryptographically sign its requests, so a receiving site can tell a legitimate agent from a scraper pretending to be one.

## Why it matters

This one is informational: publishing a key directory means "we sign our outbound requests". If you do not sign, publishing it would be a lie.

## Pass criteria

A JWKS is published at /.well-known/http-message-signatures-directory.

## How to implement it

Goal: Let your site identify itself as a bot with Web Bot Auth

A JWKS is published at /.well-known/http-message-signatures-directory.

The step-by-step implementation prompt is part of the paid tier. The free layer gives you the diagnosis, the evidence and the specification links.

Specifications: https://datatracker.ietf.org/wg/webbotauth/about/, https://developers.cloudflare.com/bots/reference/bot-verification/web-bot-auth/
Implementation notes: https://agent-ready.t0ols.com/.well-known/agent-skills/web-bot-auth/SKILL.md