Fingerprint's Free Web Bot Auth Testing Tool for AI Agent Developers
What Web Bot Auth Is and Why It Matters
Web Bot Auth (WBA) is an emerging open standard progressing through the IETF that enables automated clients to cryptographically sign their HTTP requests. Legacy identification methods like User-Agent strings can be easily spoofed, and IP allow lists are time-consuming and gameable. WBA solves this by allowing bot operators to generate asymmetric key pairs, host public keys in discoverable directories, and sign outbound requests with private keys.
How Web Bot Auth Signing Works
A properly signed WBA request includes three headers:
Signature-Inputdefines the components being signed and parameters including: tag set toweb-bot-auth,keyidmatching the JSON Web Key (JWK) thumbprint of your signing key,createdandexpirestimestamps, and anonce(strongly recommended to reduce replay risk)Signaturecontains the actual cryptographic signature over those componentsSignature-Agentpoints to your key directory, making it easier for servers to discover and cache your public key
Fingerprint requires Ed25519 keys, and your key directory needs to be hosted over HTTPS at /.well-known/http-message-signatures-directory, with the directory response itself signed to prevent someone else from mirroring it.
The Free Testing Tool
Fingerprint's Web Bot Auth testing page is a free, public endpoint where you can send a signed request and get clear feedback on whether your signature validates correctly. No account is required, and the testing tool is open source with frontend and backend repositories available.
The endpoint is at: fingerprint.com/web-bot-auth/test/
Getting Started with WBA
If you're implementing WBA:
- Generate an Ed25519 key pair and convert your public key to JWK format
- Host your key directory at
/.well-known/http-message-signatures-directoryover HTTPS, with the directory response signed using your private key - Sign your bot's outbound HTTP requests with the
Signature-Input,Signature, andSignature-Agentheaders - Send a test request to
fingerprint.com/web-bot-auth/test/to confirm everything validates
When your bot signs requests correctly, sites using Fingerprint Bot Detection can identify it as a signed bot rather than treating it as unknown automated traffic.
📖 Read the full source: HN AI Agents
👀 See Also
Zerro: Point at Your Live App, Speak, and Watch Claude Code Edit It Instantly
Zerro is a Mac app that lets you point your cursor at a running app, describe a change aloud, and have Claude Code edit the real files live. It captures motion, resolves which element you mean, and checkpoints before each run.
Eden AI: European API Hub for AI Models – Pivots as OpenRouter Alternative
Eden AI offers a single unified API to access 500+ AI models (LLMs, vision, OCR, speech) with smart routing, fallback mechanisms, and region control. Positioned as a European alternative to OpenRouter.
htmLLM-124M v2 Released: Specialized HTML/Bootstrap Autocomplete Model
LH-Tech-AI released htmLLM-124M v2, a 124M parameter model specialized for HTML/Bootstrap autocompletion that achieves 0.91 validation loss and trains in ~8 hours on a single T4 GPU.
Holisto Seed: A Local LLM Framework with Persistent Identity and Consensual Memory Consolidation
Holisto Seed is a Relational Individuation Framework that gives LLM agents persistent identity, biographical memory, and co-evolutionary relationships with users. It runs fully local with a Git-based versioning system and features a consensual sleep cycle for memory consolidation.