Is Web Bot Auth a standard?

It builds on RFC 9421. Its own draft is in progress at the IETF. Check that draft's status before relying on it.

Does ARC sign its requests?

The methodology says the catalog check is a real HTTP request identified as ARCBot. It does not describe Web Bot Auth signatures. This page does not guess past that.

Can ARC tell if my store checks signatures?

No. That is not visible from outside, so it is not measured.

ARC · Answers

What is Web Bot Auth?

Web Bot Auth is a way for an AI agent to sign its web requests so a site or its CDN can check who sent them, using HTTP message signatures (RFC 9421). Card-network programmes and some Shopify agent files rely on it. ARC cannot see whether a store verifies signatures, so that is not measured.

Short answer

Web Bot Auth lets an agent sign an HTTP request so the site, or its CDN, can check who sent it. It builds on HTTP message signatures, RFC 9421. The IETF draft for Web Bot Auth itself is separate. Check that draft's status before you rely on it.

How signing works

The agent adds a signature the server can verify against a published key. A valid signature says who claims to have sent the request. It does not, by itself, grant a checkout.

Who uses it

Visa's Trusted Agent Protocol and Mastercard Agent Pay use signed agent requests. Some Shopify agent files, including Allbirds' public /agents.md, tell server-side agents to use Web Bot Auth. Those are the programmes' rules, not an ARC adoption count.

Why it matters for blocking

A store can challenge anonymous automation and still let a signed agent through. ARC does not measure which stores have done that.

What ARC can and cannot see

Whether a store verifies signatures: Not measuredNot measuredSignature checks happen at the merchant or the CDN. They are not in dataset 2026-10-12.r2, and they are not visible from outside.Snapshot 2026-10-12.r2, 12 October 2026.

ARC's methodology says the catalog check is a real HTTP request identified as ARCBot. The method page does not describe Web Bot Auth signatures on that request. This page does not guess past that sentence.

Frequently asked questions

What is Web Bot Auth?: Web Bot Auth is a way for an AI agent to sign its web requests so a site or its CDN can check who sent them, using HTTP message signatures (RFC 9421). Card-network programmes and some Shopify agent files rely on it. ARC cannot see whether a store verifies signatures, so that is not measured.
Is Web Bot Auth a standard?: It builds on RFC 9421. Its own draft is in progress at the IETF. Check that draft's status before relying on it.
Does ARC sign its requests?: The methodology says the catalog check is a real HTTP request identified as ARCBot. It does not describe Web Bot Auth signatures. This page does not guess past that.
Can ARC tell if my store checks signatures?: No. That is not visible from outside, so it is not measured.

On ARC

Cite this: ARC, arcreport.ai, accessed 2026-10-13, index snapshot 2026-10-12.r2, CC-BY-4.0. Protocol figures: Live saved checks, accessed 13 October 2026. Not a frozen snapshot. Index browser figures: Snapshot 2026-10-12.r2, 12 October 2026. Platform figures: Live saved checks, accessed 13 October 2026. Not a frozen snapshot.

Every figure is labelled Measured, Inferred or Not measured. Not measured is not zero. A missing result is not a mark against a store. ARC stops before payment.