---
title: "Web Bot Auth, defined | Agent Ready Checkout"
description: "Web Bot Auth: An IETF draft for bots and agents to sign HTTP requests with HTTP Message Signatures and a published key. Dated and sourced."
canonical: https://agentreadycheckout.com/glossary/web-bot-auth
site: "Agent Ready Checkout"
last_updated: 2026-11-04
section: "Glossary"
---

# Web Bot Auth, defined | Agent Ready Checkout

> Web Bot Auth: An IETF draft for bots and agents to sign HTTP requests with HTTP Message Signatures and a published key. Dated and sourced.

Source: https://agentreadycheckout.com/glossary/web-bot-auth
Site: Agent Ready Checkout
Last reviewed: 2026-11-04

Glossary

# Web Bot Auth

In short

Web Bot Auth: An IETF draft for bots and agents to sign HTTP requests with HTTP Message Signatures and a published key, used as the identity layer by TAP and Agent Pay. Web Bot Auth appears in 6 sourced facts on this site, the first in Visa Trusted Agent Protocol (TAP).

## Definition

An IETF draft for bots and agents to sign HTTP requests with HTTP Message Signatures and a published key, used as the identity layer by TAP and Agent Pay.

## Example

Cloudflare validates Web Bot Auth signatures for TAP and Agent Pay at the edge. [blog.cloudflare.com](https://blog.cloudflare.com/secure-agentic-commerce/), read 4 Nov 2026.

## Where it appears in the sourced facts

-   Visa says TAP is built on the HTTP Message Signature standard and aligned with the IETF Web Bot Auth work, using agent-specific cryptographic signatures. [usa.visa.com](https://usa.visa.com/about-visa/newsroom/press-releases.releaseId.21716.html), read 4 Nov 2026. In [Visa Trusted Agent Protocol (TAP)](https://agentreadycheckout.com/protocols/visa-trusted-agent-protocol).
-   Cloudflare wrote on 24 Oct 2025 that both TAP and Mastercard Agent Pay use Web Bot Auth as the agent authentication layer, and that merchants can rely on Cloudflare to validate signatures (Signature-Input and Signature headers, Ed25519). [blog.cloudflare.com](https://blog.cloudflare.com/secure-agentic-commerce/), read 4 Nov 2026. In [Visa Trusted Agent Protocol (TAP)](https://agentreadycheckout.com/protocols/visa-trusted-agent-protocol).
-   Merchants can verify agents with no code changes by applying Web Bot Auth at the CDN layer, per the framework. [mastercard.com](https://www.mastercard.com/us/en/news-and-trends/stories/2025/agentic-commerce-framework.html), read 4 Nov 2026. In [Mastercard Agent Pay](https://agentreadycheckout.com/protocols/mastercard-agent-pay).
-   Cloudflare: both TAP and Agent Pay use Web Bot Auth as the agent authentication layer. [blog.cloudflare.com](https://blog.cloudflare.com/secure-agentic-commerce/), read 4 Nov 2026. In [What TAP and Agent Pay change at the WAF](https://agentreadycheckout.com/guides/tap-and-agent-pay-at-the-waf).
-   Mastercard: merchants can verify agents with Web Bot Auth at the CDN without new code. [mastercard.com](https://www.mastercard.com/us/en/news-and-trends/stories/2025/agentic-commerce-framework.html), read 4 Nov 2026. In [What TAP and Agent Pay change at the WAF](https://agentreadycheckout.com/guides/tap-and-agent-pay-at-the-waf).

## Nearby terms

-   [HTTP Message Signatures](https://agentreadycheckout.com/glossary/http-message-signatures)
-   [Visa Intelligent Commerce](https://agentreadycheckout.com/glossary/visa-intelligent-commerce)
-   [Trusted Agent Protocol (TAP)](https://agentreadycheckout.com/glossary/trusted-agent-protocol-tap)
-   [All terms](https://agentreadycheckout.com/glossary)

## Sources

1.  [Cloudflare: Secure agentic commerce](https://blog.cloudflare.com/secure-agentic-commerce/), read 4 Nov 2026
2.  [Visa Introduces Trusted Agent Protocol](https://usa.visa.com/about-visa/newsroom/press-releases.releaseId.21716.html), read 4 Nov 2026
3.  [Mastercard Agent Pay Acceptance Framework](https://www.mastercard.com/us/en/news-and-trends/stories/2025/agentic-commerce-framework.html), read 4 Nov 2026

Last reviewed 4 Nov 2026

## Edition

Matrix edition of 4 Nov 2026.

Reviewed 4 Nov 2026, [3 sources](#sources-h).

## Method

[How cells, sources and read dates are defined](https://agentreadycheckout.com/method)