Web Bot Auth is an IETF working group, and the specifications it produces, for bots and agents to cryptographically identify themselves to websites using HTTP Message Signatures. Visa’s TAP and Mastercard Agent Pay both build on it.
Web Bot Auth
Web Bot Auth is an IETF working group, and the specifications it produces, for bots and agents to cryptographically identify themselves to websites using HTTP Message Signatures. Visa’s TAP and Mastercard Agent Pay both build on it.
Where it stands
As of 2026-10-26, the Agentic Standards Map records:
Active Working Group (WG), listed for coordination by the draft W3C Agentic Web charter; the first WG draft, draft-ietf-webbotauth-httpsig-protocol-00, was adopted on 2026-09-01, and a two-hour session was requested for IETF 127 on 2026-09-15. Implementation reports and proposed edits to the draft were on the list between 2026-10-04 and 2026-10-13. On 2026-10-13 the datatracker listed draft-ietf-webbotauth-httpsig-protocol-00 (2026-09-01) as the only WG draft, and it still did on 2026-10-26 (API: one draft in the group, revision 00). …
Why it matters to agents
The WG standardises cryptographic authentication of automated clients (HTTP message signatures, key directories), which a seller or its content delivery network (CDN) can use to tell which agent is calling. …
Sources
- https://datatracker.ietf.org/wg/webbotauth/about/
- https://mailarchive.ietf.org/arch/msg/web-bot-auth/IHIsC9v_WDK_fv2SalA4KeMl8GI
- https://mailarchive.ietf.org/arch/msg/web-bot-auth/kLfrqebxXiW6jcu8hd-f1i7Li6s
- https://mailarchive.ietf.org/arch/msg/web-bot-auth/5SUKkvPEzPD66hwFexDkP1dl7ko
- https://datatracker.ietf.org/wg/webbotauth/documents/
- https://datatracker.ietf.org/doc/draft-illyes-webbotauth-cbcp/
Status and relevance quoted, shortened, from the Agentic Standards Map by Francesco Marinoni Moretto, CC BY 4.0, https://frmoretto.github.io/agentic-standards-map/. The full entry, with every dated source, is in map.json under ietf-webbotauth.
Industry: security
Related standards
Standards this one builds on, supersedes, profiles or is commonly deployed beside.
