Web Bot Auth

Definition

An IETF draft for bots and agents to sign HTTP requests with HTTP Message Signatures and a published key, used as the identity layer by TAP and Agent Pay.

Example

Cloudflare validates Web Bot Auth signatures for TAP and Agent Pay at the edge. blog.cloudflare.com, read 4 Nov 2026.

Where it appears in the sourced facts

• Visa says TAP is built on the HTTP Message Signature standard and aligned with the IETF Web Bot Auth work, using agent-specific cryptographic signatures. usa.visa.com, read 4 Nov 2026. In Visa Trusted Agent Protocol (TAP).
• Cloudflare wrote on 24 Oct 2025 that both TAP and Mastercard Agent Pay use Web Bot Auth as the agent authentication layer, and that merchants can rely on Cloudflare to validate signatures (Signature-Input and Signature headers, Ed25519). blog.cloudflare.com, read 4 Nov 2026. In Visa Trusted Agent Protocol (TAP).
• Merchants can verify agents with no code changes by applying Web Bot Auth at the CDN layer, per the framework. mastercard.com, read 4 Nov 2026. In Mastercard Agent Pay.
• Cloudflare: both TAP and Agent Pay use Web Bot Auth as the agent authentication layer. blog.cloudflare.com, read 4 Nov 2026. In What TAP and Agent Pay change at the WAF.
• Mastercard: merchants can verify agents with Web Bot Auth at the CDN without new code. mastercard.com, read 4 Nov 2026. In What TAP and Agent Pay change at the WAF.

Nearby terms

• HTTP Message Signatures
• Visa Intelligent Commerce
• Trusted Agent Protocol (TAP)
• All terms