Fingerprint's Free Web Bot Auth Testing Tool for AI Agent Developers
What Web Bot Auth Is and Why It Matters
Web Bot Auth (WBA) is an emerging open standard progressing through the IETF that enables automated clients to cryptographically sign their HTTP requests. Legacy identification methods like User-Agent strings can be easily spoofed, and IP allow lists are time-consuming and gameable. WBA solves this by allowing bot operators to generate asymmetric key pairs, host public keys in discoverable directories, and sign outbound requests with private keys.
How Web Bot Auth Signing Works
A properly signed WBA request includes three headers:
Signature-Inputdefines the components being signed and parameters including: tag set toweb-bot-auth,keyidmatching the JSON Web Key (JWK) thumbprint of your signing key,createdandexpirestimestamps, and anonce(strongly recommended to reduce replay risk)Signaturecontains the actual cryptographic signature over those componentsSignature-Agentpoints to your key directory, making it easier for servers to discover and cache your public key
Fingerprint requires Ed25519 keys, and your key directory needs to be hosted over HTTPS at /.well-known/http-message-signatures-directory, with the directory response itself signed to prevent someone else from mirroring it.
The Free Testing Tool
Fingerprint's Web Bot Auth testing page is a free, public endpoint where you can send a signed request and get clear feedback on whether your signature validates correctly. No account is required, and the testing tool is open source with frontend and backend repositories available.
The endpoint is at: fingerprint.com/web-bot-auth/test/
Getting Started with WBA
If you're implementing WBA:
- Generate an Ed25519 key pair and convert your public key to JWK format
- Host your key directory at
/.well-known/http-message-signatures-directoryover HTTPS, with the directory response signed using your private key - Sign your bot's outbound HTTP requests with the
Signature-Input,Signature, andSignature-Agentheaders - Send a test request to
fingerprint.com/web-bot-auth/test/to confirm everything validates
When your bot signs requests correctly, sites using Fingerprint Bot Detection can identify it as a signed bot rather than treating it as unknown automated traffic.
📖 Read the full source: HN AI Agents
👀 See Also
Maggy: An Autonomous Engineering Platform on Claude Code with Cross-Session Memory and P2P Team Learning
Maggy sits at Level 4 of the AI coding tool spectrum: multi-model orchestration, cross-session memory, process intelligence from CI/reviews, and P2P team learning. Benchmarks show 83% reduction in Claude usage while catching 7 security issues missed by single-pipeline Claude Code.
Single-call MCP pipeline reduces Claude Code token usage by 74%
A developer built a context engine MCP server that provides Claude Code with a dependency graph of codebases, reducing token usage by 65% initially. A new single-call pipeline further cuts tokens by 74% by eliminating multiple round trips and deduplicating results server-side.
Claude for Design Work: How to Stop Repeating the Same Taste Arguments Every Session
A developer running client work through Claude describes the core problem: Claude has no memory of rejected design decisions, leading to generic outputs and inconsistent brand identity.
Bodega Inference Engine: Optimizing LLM Inference for Apple Silicon's Unified Memory
Bodega is an inference engine built specifically for Apple Silicon's unified memory architecture, addressing throughput limitations by redesigning continuous batching and KV cache management for MLX. The developer reports working on it for 2.5 years with optimizations close to the Metal layer.