Early release

Sites block anonymous agents. Give yours a passport.

Airlines, banks and marketplaces are turning AI agents away because they cannot tell a helpful assistant from abuse. Agent Pass is the honest fix: your agent signs each request with a key it controls, the site checks who is calling, and decides what that agent may do. No disguises, no fake browsers.

The line we hold: this does not get an agent past a block it was not invited through. It gives sites a standard way to say yes to agents that identify themselves, and gives agent builders something concrete to ask sites for. It uses Web Bot Auth, an open IETF draft that Cloudflare documents support for.

How it works

1. The agent signs

Each request carries three headers: Signature-Agent (where its public key lives), Signature-Input and Signature (an Ed25519 signature over the host and the key location, valid for minutes, with a one time nonce).

2. The site verifies

It fetches the agent's key directory, matches the key, checks the signature, the time window and that the nonce was never seen. Then it applies its own rules: read only, rate limits, or a licence.

3. The site stays in control

Unidentified traffic gets a clear machine readable 403 that says how to identify. Identified agents get what the site decides. A site can revoke any agent at any time.

Live demo

A stand in "site" at /demo/protected runs the real verifier. The demo agent below signs with a real Ed25519 key. Press a button and read the actual headers and response.

Add it to your stack

Agent side: sign requests

import { signRequest } from "./webbotauth.js"; // /webbotauth.js, plain WebCrypto, no dependencies const headers = await signRequest("https://shop.example/prices", "https://my-agent.example", privateJwk); const res = await fetch("https://shop.example/prices", { headers });

Host your public key at https://my-agent.example/.well-known/http-message-signatures-directory as a JWKS (content type application/http-message-signatures-directory+json). This demo's own directory is here.

Site side: verify

import { verifyRequest } from "./webbotauth.js"; const v = await verifyRequest({ authority: url.host, headers }, { getDirectory, seenNonce }); if (!v.ok) return new Response(JSON.stringify({error:"agent_not_identified"}), {status:403});

Or call the hosted check: POST /api/verify with {"url":"...","headers":{...}}. Policy summary at /api/v1/policy. Source for both functions is one file: /webbotauth.js.

Limits you should know

Web Bot Auth is an IETF draft, not a final standard. Whether a given site or network honours it is the site's choice. Cloudflare documents support for verified bots and agents; other sites need to adopt it.
This early release verifies signatures, time windows and replay. It does not yet check the directory response signature, does not host directories for other people, and the demo site is ours, not a real airline or bank.
Fetching a key directory from another origin is implemented, but I could not prove it live: my only test origin was another Worker on the same Cloudflare account, and the fetch from inside this Worker returned 404 although the same URL returns 200 from outside. Treat remote directory lookup as untested until you try it against your own host.
Replay protection uses a free tier key value store. If its daily quota is hit, verification fails closed with a 503 until 00:00 UTC.
Identification is not permission. Sites should still apply their own scopes and rate limits. Pair it with Trust Gateway so the agent's owner controls what the agent may do.