Fingerprint's Free Web Bot Auth Testing Tool for AI Agent Developers
What Web Bot Auth Is and Why It Matters
Web Bot Auth (WBA) is an emerging open standard progressing through the IETF that enables automated clients to cryptographically sign their HTTP requests. Legacy identification methods like User-Agent strings can be easily spoofed, and IP allow lists are time-consuming and gameable. WBA solves this by allowing bot operators to generate asymmetric key pairs, host public keys in discoverable directories, and sign outbound requests with private keys.
How Web Bot Auth Signing Works
A properly signed WBA request includes three headers:
Signature-Inputdefines the components being signed and parameters including: tag set toweb-bot-auth,keyidmatching the JSON Web Key (JWK) thumbprint of your signing key,createdandexpirestimestamps, and anonce(strongly recommended to reduce replay risk)Signaturecontains the actual cryptographic signature over those componentsSignature-Agentpoints to your key directory, making it easier for servers to discover and cache your public key
Fingerprint requires Ed25519 keys, and your key directory needs to be hosted over HTTPS at /.well-known/http-message-signatures-directory, with the directory response itself signed to prevent someone else from mirroring it.
The Free Testing Tool
Fingerprint's Web Bot Auth testing page is a free, public endpoint where you can send a signed request and get clear feedback on whether your signature validates correctly. No account is required, and the testing tool is open source with frontend and backend repositories available.
The endpoint is at: fingerprint.com/web-bot-auth/test/
Getting Started with WBA
If you're implementing WBA:
- Generate an Ed25519 key pair and convert your public key to JWK format
- Host your key directory at
/.well-known/http-message-signatures-directoryover HTTPS, with the directory response signed using your private key - Sign your bot's outbound HTTP requests with the
Signature-Input,Signature, andSignature-Agentheaders - Send a test request to
fingerprint.com/web-bot-auth/test/to confirm everything validates
When your bot signs requests correctly, sites using Fingerprint Bot Detection can identify it as a signed bot rather than treating it as unknown automated traffic.
📖 Read the full source: HN AI Agents
👀 See Also
Claw Compactor: 14-stage token compression engine for LLM pipelines
Claw Compactor is an open-source LLM token compression engine using a 14-stage Fusion Pipeline to achieve 54% average compression with zero LLM inference cost. It includes specialized compressors for code, JSON, logs, diffs, and search results with reversible compression capabilities.
Local 35B MoE Model Drops Agent OS Code Failure Rate to 0%
A developer reports that switching a multi-agent system's runtime to Qwen 3.6 35B A3B (MoE, 3B active params) eliminated code failures, achieving 100% success rate through a 5-layer validation gate.
NVIDIA Announces NemoClaw Agent Platform with Privacy Controls
NVIDIA has launched NemoClaw, an agent platform that lets users install Nimotron models and the Open Shell runtime with a single command while adding privacy and security controls for autonomous agents.
GoStaff: Go Rewrite of OpenClaw with 100x Memory Reduction
GoStaff is a Go rewrite of OpenClaw that uses approximately 100x less memory (~17MB) while maintaining OpenClaw plugin compatibility through a JavaScript shim. It features a three-tier skill system, unified Postgres persistence, and multi-provider ReAct loops.