{"id":125636,"date":"2026-05-05T21:03:19","date_gmt":"2026-05-05T21:03:19","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2026\/05\/05\/google-testing-web-bot-auth-to-verify-ai-agent-requests\/"},"modified":"2026-05-05T21:04:18","modified_gmt":"2026-05-05T21:04:18","slug":"google-testing-web-bot-auth-to-verify-ai-agent-requests","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2026\/05\/05\/google-testing-web-bot-auth-to-verify-ai-agent-requests\/","title":{"rendered":"Google Testing Web Bot Auth To Verify AI Agent Requests"},"content":{"rendered":"

<\/a>\n
<\/p>\n

\n

Google revealed documentation<\/a> explaining its testing of Net Bot Auth, an experimental IETF protocol that may assist web sites cryptographically confirm some automated requests from bots and AI brokers.<\/p>\n

The protocol provides one other verification layer by letting brokers signal HTTP requests with cryptographic keys. Web sites can then confirm these signatures towards revealed public keys to substantiate the request got here from who it claims to be.<\/p>\n

What\u2019s New<\/h2>\n

Net Bot Auth makes use of HTTP Message Signatures<\/a> (RFC 9421) to let automated purchasers signal outgoing requests. A bot holds a non-public key, publishes its public key at a identified URL, and indicators every request. The receiving web site checks the signature towards the general public key to substantiate id.<\/p>\n

Google says a subset of signed Google-Agent requests are authenticated as https:\/\/agent.bot.goog<\/code>. Signed requests embrace a Signature-Agent<\/code> HTTP header set to g=\"https:\/\/agent.bot.goog\"<\/code>, and the corresponding signature will be verified utilizing public keys revealed at that area\u2019s .well-known<\/code> listing.<\/p>\n

In line with Google\u2019s documentation, bot-detection providers, CDNs, and WAFs already assist the protocol. The IETF draft<\/a> is authored by Thibault Meunier of Cloudflare and Sandor Main of Google. Cloudflare publishes a reference implementation on GitHub<\/a>.<\/p>\n

The IETF Web Bot Auth Working Group<\/a> was chartered in early 2026 with milestones for standards-track specs and a greatest present observe doc.<\/p>\n

What Google Is Not Doing But<\/h2>\n

Not all Google consumer brokers are collaborating. The documentation says Google is testing with \u201csome AI brokers hosted on Google infrastructure\u201d however doesn’t title which of them past the Google-Agent<\/a> user-triggered fetcher.<\/p>\n

Even for collaborating brokers, not each request is signed. The documentation recommends that websites proceed counting on IP addresses, reverse DNS, and user-agent strings<\/a> as the first verification methodology whereas signed visitors rolls out step by step.<\/p>\n

The Web-Draft might change because the working group develops the usual.<\/p>\n

Why This Issues<\/h2>\n

Bot impersonation has been a persistent downside. Scrapers and dangerous actors can spoof user-agent strings to disguise their visitors as Googlebot or different official crawlers, making it tougher for website homeowners to inform actual bot visitors from pretend.<\/p>\n

We covered this issue<\/a>\u00a0when Google\u2019s Martin Splitt warned that \u201cnot everybody who claims to be Googlebot truly is Googlebot.\u201d The out there verification strategies on the time have been reverse DNS lookups and IP vary checks. Net Bot Auth would add a layer that may\u2019t be solid with out the agent\u2019s non-public key.<\/p>\n

For websites already utilizing a CDN or WAF that helps the protocol, verification could occur robotically. For everybody else, the experimental standing means there isn’t a urgency to behave. The documentation recommends treating current verification because the default and Net Bot Auth as supplementary.<\/p>\n

Wanting Forward<\/h2>\n

Net Bot Auth remains to be shifting via the requirements course of, and Google\u2019s implementation stays experimental.<\/p>\n

For now, the sensible change is visibility. Web sites could begin seeing signed requests from some Google-Agent visitors, whereas current verification strategies stay the default.<\/p>\n

The subsequent query is whether or not extra AI brokers undertake signed requests, and whether or not internet hosting suppliers make verification computerized for web sites that don\u2019t wish to handle keys.<\/p>\n<\/div>\n