Verify your (good) bots.
Web Bot Auth lets good bots prove who they are, cryptographically.
Signing keys and a human-readable description for your bot can live securely, right on your Verify portal.
Servers verify your crawler and let it through instead of blocking.
AcmeBot
Operated by Acme, Inc. · acme.com
Signing keys (JWKS)
Ed25519 · kid: 3Kaslj…xHs
User-Agent
acmebot/1.0 (+verify.acme.com/bot/acmebot)
The new standard
Web Bot Auth
is an emerging standard.
It lets automated agents (bots) prove their identity to the websites they visit.
How it works
Rather than trusting an easily-faked user-agent string, a bot signs its requests with HTTP Message Signatures and points the origin to its public keys.
Servers verify the signature and know the request is genuine from that operator.
Where it lives
Web Bot Auth needs two things published at a reliable address: a set of public keys, and a description of the bot.
Both live on your Stingray Verify portal,
right alongside the rest of your published trust details on your own domain.
What you get
Everything your bot needs to be trusted
Hosted keys, a verifiable description, and a domain-linked identity all standards-compliant, none of it your infrastructure to run.
{
"keys": [{
"kty": "OKP",
"crv": "Ed25519",
"kid": "3Kaslj…xHs",
"x": "11qYAYK…IlA"
}]
}A hosted JWKS endpoint
We serve your bot's Ed25519 public keys as a standards-compliant JWKS at a stable, always-online URL.
Origin servers fetch it to verify the signatures your bot sends, so you don't need key-hosting infrastructure to build or keep up.
AcmeBot indexes public product pages to keep our shopping results fresh. It respects robots.txt and crawls at a conservative rate.
A bot page on your Verify portal
Every bot gets a public profile on your Verify portal at verify.[yourcompany].com describing what it does, who runs it, how to reach you, and that it honors robots.txt.
It sits right beside the rest of your verified details, so site owners who see your traffic can look you up and decide to trust you.
Bot identity tied to acme.com
Served from your verified domain, so origins can trust the signature really belongs to you — not an impostor reusing your name.
Tied to your real domain
Because your bot page lives on your Verify portal, its identity is published on a page verified against your own domain.
That link between key, description, and domain is what makes the identity trustworthy, as an impostor can't reuse your name from a domain they don't control.
signature-agent: "verify.acme.com"
signature-input: sig=("@authority");
keyid="3Kaslj…xHs";
created=1712345678
signature: sig=:MEUCIQD…:Built for the Web Bot Auth standard
Web Bot Auth signs requests with HTTP Message Signatures and points origins to your keys with a signature-agent header.
Host that directory with us and any server implementing the standard can verify your bot out of the box.
Publish a new key before retiring the old one — verifiers never see a gap.
Rotate keys without downtime
Publish a new key before retiring the old one, so verifiers always find a valid key and never see a gap.
Roll your signing keys on your own schedule without breaking a single crawl.
No servers to run, no endpoints to keep online — we host it.
Live in minutes, no servers
Generate a key pair, upload the public key, describe your bot, and point your signer at the hosted directory.
There's nothing to deploy and no endpoint for you to keep online: we handle the hosting and uptime.
Questions, answered
Web Bot Auth, explained
What is Web Bot Auth?
Web Bot Auth is an emerging standard for letting automated agents prove their identity to the websites they visit. Instead of relying on an easily-spoofed User-Agent string or a hard-coded IP list, a bot cryptographically signs its requests using HTTP Message Signatures, and the origin server verifies that signature against the bot operator's published public keys.
Where do my bot pages live?
On your Stingray Verify portal, at verify.[yourcompany].com/bot/[yourbot]. Bot hosting is part of the same product that publishes your verified company and payment details, so your keys and bot description sit on the same domain-verified page as the rest of your trust information.
What is a JWKS? Why do I need to host one?
A JWKS (JSON Web Key Set) is a small JSON document listing your bot's public keys. Origin servers fetch it to verify the signatures your bot sends. It has to live at a stable, reliable URL which is exactly what we host for you, so you don't have to run and maintain an endpoint yourself.
How does an origin server verify my bot?
Your bot signs each request and includes a signature-agent header pointing at your hosted directory. The origin fetches your JWKS, checks the signature against the referenced key, and confirms the request really came from you. Then it can let your bot through instead of blocking or challenging it.
Do I need this if my bot already sends a User-Agent?
A User-Agent string is trivial to fake, so more sites now block or throttle unverified traffic.
Web Bot Auth gives your crawler a cryptographic identity that origins can actually trust.
What kind of keys do you support?
Ed25519 signing keys, published as a standard JWKS. You keep the private key; we host the public key set and your bot's description, and support rotation so you can roll keys with no downtime.
What does it cost?
Start with a 2-week free trial. No setup fee and no card required to get your bot published.