Protocol / standardPublic reference
Web Bot Auth
Signed HTTP identification for bots and agents
Uses cryptographic HTTP message signatures and published keys to identify automated requests.
THE QUESTION IT ADDRESSES
Can a website verify the identity behind an agent’s HTTP request?
A concise reading of published information. The explanatory grouping below is editorial, not an implementation test.
A simplified mechanism
- Publish verification keys through the directory mechanism.
- Sign requests and verify the signature against the appropriate key.
What it does not establish
The underlying IETF documents are drafts. A valid signature identifies a requester; it does not prove purchase consent, supply a spending budget or settle money.
Where it fits
A request-authentication layer relevant to merchant access controls; Visa TAP adds commerce-specific context and program requirements.
Sources & further reading
Sources reviewed on2026-11-01. Summaries are paraphrased; follow the current source for changes.