Message Signatures join Cloudflare's Verified Bots program

Identifying good bots has traditionally meant checking IP ranges and user-agent strings — both of which are imperfect. IP ranges can be shared or change, and user-agent headers are trivial to spoof. Cloudflare proposed an alternative in May 2025: HTTP Message Signatures, a method for bot operators to cryptographically sign requests so site owners can verify their identity with confidence. That proposal is now moving into production.

Cloudflare is integrating HTTP Message Signatures into its Verified Bots program. Bot operators who sign requests using Message Signatures will get a faster, streamlined path to Verified Bots enrollment. Cloudflare also encourages all bot operators to adopt Message Signatures going forward, in place of existing verification mechanisms. For site owners, no action is needed on their end — Cloudflare validates signatures at the edge automatically. Successful validation marks traffic as verified, which site owners can use in Bot Management and WAF rules through the existing verified bot fields.

How enrollment works now

Previously, applying to be a Verified Bot meant submitting IP address ranges or reverse DNS names, which involved manual review to confirm the IP range was valid and tied to the right ASN. With Message Signatures, that process is simplified. Bots that submit well-formed Message Signatures will be prioritized and approved faster.

To get started, bot operators can use one of two open source libraries Cloudflare is providing: a web-bot-auth library written in Rust, and a web-bot-auth npm package in TypeScript. Other implementations can be submitted for inclusion in Cloudflare's developer documentation.

The high-level steps for signing requests are:

  • Generate a valid signing key.
  • Host a JSON web key set containing your public key at /.well-known/http-message-signature-directory on your site.
  • Sign responses for that URL with each key in the set, to prove ownership.
  • Register the URL with Cloudflare via the Verified Bots form in your account.
  • Sign outgoing requests using a Web Bot Auth library.

Cloudflare Radar's URL Scanner is already registered as a Verified Bot and provides an example of a well-formed signature in its request headers. Cloudflare automatically checks that the signature matches the request.

Application is done through the Verified Bots submission form in the Cloudflare dashboard — under Account Home → account name → Configurations → Verified Bots. In the form, select "Request Signature" as the verification method and enter the key directory URL in the Validation Instructions field. User-Agent values are optional for this method. A free Cloudflare account is sufficient to apply.

Signature verification at the edge

Cloudflare is now rolling out verification of cryptographic signatures from bots and crawlers across Free and Pro plans, with Business and Enterprise plans to follow as the system is tested at scale. Verification works as follows:

  1. A bot sends a request to a site behind Cloudflare.
  2. Cloudflare checks for the Signature, Signature-Input, and Signature-Agent headers.
  3. It confirms the keyid parameter in Signature-Input points to a known key.
  4. It checks the expires parameter — if the request is expired, verification fails, preventing replay attacks.
  5. It verifies the tag parameter is set to web-bot-auth.
  6. It builds a signature base from the components listed in Signature-Input.
  7. It verifies the signature against that base using the ed25519 algorithm and the key from keyid.
  8. Successful verification identifies the bot, and rules are applied accordingly.

If any check fails, Cloudflare falls back to existing bot identification and mitigation methods. Over time, the verification requirements will be strengthened to reduce the possibility of a downgrade.

Site owners can segment verified bot traffic by type using the cf.verified_bot_category field in WAF custom rules, Advanced Rate Limiting, and Late Transform rules. For example, a rule can allow only bots in the Academic Research category, covering institutions like the Bibliothèque nationale de France and the Library of Congress.

What's next

HTTP Message Signatures were standardized by the IETF in RFC 9421, and the Web Bot Auth specifications are being developed in the open. The IETF is considering forming a working group around Web Bot Auth, and Cloudflare invites feedback from crawlers, origins, and CDNs to help refine the approach.

The shift to Message Signatures aims to replace brittle identification methods with a secure, automated alternative — reducing friction for transparent bots that provide essential services like search indexing and monitoring, while giving site owners better assurance that bot traffic is legitimate.