Web Bot Auth: How to Verify AI Agents on Shopify

TL;DR: Web Bot Auth is a new way for AI agents to prove who they are. Instead of trusting a user-agent string that anyone can copy, the agent signs each request with a private key, and your edge checks it against a public key the operator publishes. ChatGPT's Cloud browser already signs its traffic, and Cloudflare, AWS WAF, Akamai, HUMAN, and Vercel already verify it. A signature proves identity, not intent, so Shopify brands still need a policy for verified, unverified, and spoofed agents.

Table of contents

• What is Web Bot Auth?
• How signed AI agent requests work
• Who signs and who verifies in 2026
• What a signature proves, and what it does not
• How to verify AI agents on a Shopify store
• FAQ

What is Web Bot Auth?

Web Bot Auth is a proposed internet standard that lets automated clients, including AI crawlers and AI agents, cryptographically sign their HTTP requests so a website can confirm which operator sent them. It builds on HTTP Message Signatures, published by the IETF as RFC 9421 in February 2024, and adds a small set of conventions so bots can use it at internet scale.

To understand why it matters, look at how stores identify bots today. There are two classic methods, and both are weak:

• User-agent strings. A request says "I am GPTBot" or "I am ChatGPT-User" in a header. That header is free text. Any scraper, card tester, or inventory bot can copy it in one line of code, and many do, precisely because well-known AI user agents are often allowlisted.
• IP ranges and reverse DNS. Operators publish the IP ranges their bots use, and your firewall checks the source address. This is better, but lists go stale, cloud providers re-architect, and agents that run in shared browser infrastructure do not map cleanly to a fixed set of addresses.

Web Bot Auth replaces "trust what the bot says" with "check what the bot can prove." If a request carries a valid signature from a key published at chatgpt.com, it came from OpenAI's infrastructure. A spoofer copying the user-agent string cannot forge that signature without OpenAI's private key.

This is arriving at the right moment for ecommerce. As we covered in our guide to AI shopping agents, agentic browsing is turning from a novelty into a real traffic source. Agents now browse product pages, compare prices, and build carts on behalf of shoppers. Stores need a way to let those agents in without opening the door to every bot that pretends to be one.

How signed AI agent requests work

The mechanics are simpler than the cryptography suggests. There are three moving parts: a key directory, a signed request, and a verifier.

1. The operator publishes a key directory

The bot operator generates a key pair (most deployments use Ed25519) and publishes the public key as a JSON Web Key Set at a well-known path on a domain it controls: /.well-known/http-message-signatures-directory. OpenAI, for example, publishes its keys at chatgpt.com under that path. Because the directory lives on the operator's own HTTPS domain, trusting the directory is the same as trusting the domain.

2. The agent signs every request

When the agent fetches a page, it adds three headers:

• Signature-Agent points to the operator's key directory, such as "https://chatgpt.com".
• Signature-Input lists which parts of the request are covered by the signature (typically the host being requested and the Signature-Agent header itself) plus metadata: the key ID, a creation time, an expiry time, a random nonce, and a tag of web-bot-auth.
• Signature carries the signature bytes.

3. The verifier checks it at the edge

Your CDN, WAF, or bot management layer reads the Signature-Agent header, fetches and caches the public key from the directory, rebuilds the signed content from the request, and verifies the signature. It also checks the expiry window. If everything matches, the request is tagged as coming from that operator. If the signature fails or has expired, the request is treated like any other unverified traffic.

Two design details are worth knowing. First, signatures are short-lived. Cloudflare's documentation recommends expiry windows of about a minute, which limits how long a captured signature could be replayed. Second, the signature covers the host being requested, so a signature made for one site cannot simply be pasted onto a request to another.

Who signs and who verifies in 2026

Web Bot Auth is unusual because deployment ran ahead of standardization. The IETF chartered a working group for it in October 2025, but as of August 2026 that group had not formally adopted any draft. Meanwhile, the companies that sit between agents and websites have already shipped it.

On the signing side:

• OpenAI. ChatGPT's agent, which runs in OpenAI's Cloud browser, signs outbound requests with a Signature-Agent of chatgpt.com. OpenAI's allowlisting documentation tells site operators to verify these signatures rather than rely on IP addresses.
• Google. Google has an experimental program where its agent traffic signs a subset of requests. Google says not all of its user agents use Web Bot Auth yet, so IP verification remains the fallback.
• Other agent platforms. Browser automation providers and smaller agent companies are registering signed agents with the major bot directories, because being verifiable is quickly becoming the price of admission.

On the verifying side:

• Cloudflare uses Web Bot Auth in its Verified Bots program and a newer Signed Agents category for user-directed agents. Its Web Bot Auth reference documents exactly how verification works.
• AWS WAF added support in November 2025, and verified agents are allowed by default in its AI bot category.
• Akamai, HUMAN, and Vercel also verify signed requests, with Vercel doing so automatically.

The practical takeaway: across much of the web, a valid signature is already the difference between an AI agent being challenged and being waved through. The default is tilting from "block unknown automation" to "allow verified automation, scrutinize the rest."

What a signature proves, and what it does not

This is where many takes on Web Bot Auth go wrong. A valid signature is powerful, but it answers exactly one question: which operator's infrastructure sent this request? It does not answer the questions a merchant actually cares about.

What it proves

• The request came from the operator that controls the published key, for example OpenAI.
• The request was signed recently and for your specific host.
• A bot claiming to be ChatGPT without a valid signature is, at best, unverified and, at worst, an impostor.

What it does not prove

• Who the human is. The working group's charter explicitly puts end-user authentication out of scope. One signed agent platform serves thousands of different users with different goals.
• What the agent intends to do. A verified agent can still be pointed at your catalog to harvest prices, check stock on a limited drop every few seconds, or test discount codes. Identity and intent are separate problems.
• That the traffic is good for your business. Verification tells you who to hold accountable. It does not tell you whether a given session will convert, inflate your analytics, or add load during a launch.
• Anything about unsigned traffic. Most bots will never sign. The scrapers, card testers, and hoarding bots that cost ecommerce brands real money have every incentive to stay anonymous.

This is why Web Bot Auth does not replace bot management; it sharpens it. It gives you a reliable way to sort a new class of traffic into a "known operator" lane. Everything outside that lane still needs behavioral detection. If you want the broader framework for that sorting, our breakdown of good bots vs bad bots on Shopify covers how to think about each category.

There is also a quieter risk: spoofing gets more tempting, not less. As verified agents earn easier access, attackers have more reason to impersonate them with copied headers. A store that allowlists by user-agent string instead of by signature is exposed to exactly that attack.

How to verify AI agents on a Shopify store

Here is the catch for Shopify brands. Shopify runs its own edge network in front of every storefront, and merchants cannot write custom firewall rules on it, inspect request headers, or verify signatures themselves. If you want to verify AI agents on Shopify, the verification has to happen in a layer you control, in front of the storefront.

With that layer in place, the policy itself is straightforward. Sort agent traffic into three lanes.

Lane 1: Verified agents

Requests with a valid Web Bot Auth signature from an operator you recognize. Default to allowing them on product, collection, and content pages, because these are shoppers doing research through a new interface. Then apply sensible guardrails:

• Rate limit per operator so a verified agent cannot hammer your store during a product launch.
• Keep sensitive flows, such as account login, gift card balance checks, and discount code entry, under the same protections you use for humans.
• Serve verified agents a fast, cached version of each page, so they get accurate product data without consuming origin capacity.

Lane 2: Unverified agents

Requests that claim a known AI user agent but carry no signature, or come from operators that do not sign yet. Do not block these outright, because major operators still send some unsigned traffic. Fall back to published IP ranges and reverse DNS where the operator provides them, and apply tighter rate limits and behavioral checks where they do not.

Lane 3: Spoofed and anonymous automation

Requests that claim to be a signed agent but fail verification, or that come from a known operator's user agent on an IP range that operator does not use. Treat these as hostile. A failed signature on a request that claims to be ChatGPT is one of the clearest bot signals you will ever get.

Measure what the agents are doing

Verification also unlocks better reporting. Once agent traffic is labeled at the edge, you can see which operators visit, which products they read, and how often agent sessions lead to human purchases. Keep that traffic out of your conversion rate math, too. Our guide to bot traffic in Google Analytics shows how unlabeled automation skews CVR and attribution.

A short checklist

• Stop allowlisting AI agents by user-agent string alone.
• Put an edge layer in front of your Shopify storefront that can read and verify Web Bot Auth headers.
• Define explicit rules for verified, unverified, and spoofed agents.
• Keep behavioral bot detection on for everything, including verified traffic.
• Label agent traffic in analytics so it does not distort your conversion data.
• Revisit the policy quarterly, since the standard and the list of signing operators are both moving quickly.

This is the model Nostra is built around. Nostra Edge Protect sits at the edge in front of Shopify, blocks malicious automation before it reaches your theme or checkout, and lets legitimate crawlers and agents through. Nostra Edge Detect gives you visibility into which AI systems are reading your store and how.

FAQ

Is Web Bot Auth an official standard yet?

Not yet. It builds on RFC 9421, which is a published standard, but the Web Bot Auth drafts themselves are still individual proposals inside an IETF working group chartered in October 2025. Even so, Cloudflare, AWS WAF, Akamai, HUMAN, and Vercel already verify signed requests in production, so it already shapes how agent traffic is handled across much of the web.

Can a Shopify store verify Web Bot Auth signatures without extra tools?

No. Shopify does not give merchants access to request headers or custom firewall rules at its edge, so there is no native setting to verify agent signatures. You need a bot management or edge layer in front of the storefront that performs verification and applies your policy.

Should I block AI agents that do not sign their requests?

Not by default. Many legitimate agents do not sign yet, and even Google signs only part of its agent traffic. Treat unsigned agents as unverified: check published IP ranges where available, apply tighter rate limits, and rely on behavioral detection. Reserve outright blocks for requests that fail verification or behave maliciously.

Does verifying ChatGPT's agent mean it can make purchases on my store?

Verification only proves that a request came from OpenAI's infrastructure. It says nothing about which user directed the agent or whether that user authorized a payment. OpenAI has said its Cloud browser cannot sign in to websites or complete payments at launch, so your checkout and account protections should stay exactly as they are.

How is Web Bot Auth different from robots.txt?

Robots.txt is a request: it asks well-behaved crawlers to stay away from certain paths, and nothing enforces it. Web Bot Auth is proof: it lets your edge confirm who a bot really is before deciding what to allow. Most stores need both, with robots.txt stating your policy and signature verification helping you enforce it.

Let verified agents in, keep impostors out

Web Bot Auth is the first credible answer to a question every ecommerce brand is now asking: is this AI agent really who it says it is? It will not tell you who the shopper is or whether the agent means well, but it finally makes identity checkable, and that makes every other bot decision more accurate. The brands that benefit most will be the ones that can verify signatures at the edge, give real agents a fast lane, and shut down everything pretending to be one. Book a demo with Nostra to see how much of your traffic is AI agents today, which ones are verified, and how Edge Protect keeps your Shopify store fast and safe as agentic commerce grows.