Check an agent
Is this request really from that agent?
Agents that follow Web Bot Auth sign every request and publish their keys at their own address. Check an address, or paste a request your site received, and see what the signature proves. Works for any agent, not only Auth Your Agent ones.
Nothing you paste is stored. The check fetches the agent's public key list the way your site would: HTTPS, public addresses only, at most 5 seconds and 64 kB, no redirects.
What the answers mean
- Verified
- The signature checks out against a key published at the agent's address.
- Invalid
- The signature is wrong, expired, made for another page or method, or made with a published test key.
- Not enough to decide
- The check could not finish: for example the agent's key list could not be fetched, or does not hold this key. This says nothing bad about the agent.
- Not signed
- The request carries no Web Bot Auth signature.
A verified signature proves the request came from whoever holds that agent's key. It does not say who the person behind the agent is. To check signatures on your own site, use our Python or JavaScript SDK, or the WordPress plugin.
For programs: POST /api/v1/check-agent with JSON {"request": "..."} or {"address": "https://..."}.