Fingerprint's Free Web Bot Auth Testing Tool for AI Agent Developers

What Web Bot Auth Is and Why It Matters

Web Bot Auth (WBA) is an emerging open standard progressing through the IETF that enables automated clients to cryptographically sign their HTTP requests. Legacy identification methods like User-Agent strings can be easily spoofed, and IP allow lists are time-consuming and gameable. WBA solves this by allowing bot operators to generate asymmetric key pairs, host public keys in discoverable directories, and sign outbound requests with private keys.

How Web Bot Auth Signing Works

A properly signed WBA request includes three headers:

• Signature-Input defines the components being signed and parameters including: tag set to web-bot-auth, keyid matching the JSON Web Key (JWK) thumbprint of your signing key, created and expires timestamps, and a nonce (strongly recommended to reduce replay risk)
• Signature contains the actual cryptographic signature over those components
• Signature-Agent points to your key directory, making it easier for servers to discover and cache your public key

Fingerprint requires Ed25519 keys, and your key directory needs to be hosted over HTTPS at /.well-known/http-message-signatures-directory, with the directory response itself signed to prevent someone else from mirroring it.

The Free Testing Tool

Fingerprint's Web Bot Auth testing page is a free, public endpoint where you can send a signed request and get clear feedback on whether your signature validates correctly. No account is required, and the testing tool is open source with frontend and backend repositories available.

The endpoint is at: fingerprint.com/web-bot-auth/test/

Getting Started with WBA

If you're implementing WBA:

1. Generate an Ed25519 key pair and convert your public key to JWK format
2. Host your key directory at /.well-known/http-message-signatures-directory over HTTPS, with the directory response signed using your private key
3. Sign your bot's outbound HTTP requests with the Signature-Input, Signature, and Signature-Agent headers
4. Send a test request to fingerprint.com/web-bot-auth/test/ to confirm everything validates

When your bot signs requests correctly, sites using Fingerprint Bot Detection can identify it as a signed bot rather than treating it as unknown automated traffic.