Guide
What TAP and Agent Pay change at the WAF
In short
Visa TAP and Mastercard Agent Pay both sign agent requests with Web Bot Auth. Your CDN or WAF can verify the Signature-Input and Signature headers against the agent's published key, then allow registered agents through rules that would block anonymous bots.
What the sources say
- Cloudflare: both TAP and Agent Pay use Web Bot Auth as the agent authentication layer. blog.cloudflare.com, read 4 Nov 2026.
- Cloudflare checks headers, fetches the key by keyid, checks created and expires, rejects reused nonces, validates the tag and verifies an Ed25519 signature. blog.cloudflare.com, read 4 Nov 2026.
- TAP signatures carry timestamps, a session identifier, key and algorithm identifiers, and are bound to the merchant domain and the operation. github.com, read 4 Nov 2026.
- Mastercard: merchants can verify agents with Web Bot Auth at the CDN without new code. mastercard.com, read 4 Nov 2026.
- Amazon requires agents to identify themselves with an "Agent/[agent name]" user agent and blocked Muse from 20 Sep 2026. amazon.com, read 4 Nov 2026.
- Walmart says agents that break its terms will be blocked (21 Oct 2026). corporate.walmart.com, read 4 Nov 2026.
Profiles named in this guide
Read next
Sources
- Cloudflare: Secure agentic commerce, read 4 Nov 2026
- Visa Trusted Agent Protocol repository, read 4 Nov 2026
- Mastercard Agent Pay Acceptance Framework, read 4 Nov 2026
- Amazon Conditions of Use, read 4 Nov 2026
- corporate.walmart.com/news/2026/10/Making-It-Possible-for-Agents-to-Shop-on-Behalf-of-Customers, read 4 Nov 2026
Last reviewed