If you sign your store’s or your crawler’s requests with Web Bot Auth and a signature that looks correct by the letter of the current Internet-Draft is getting rejected, you’re not doing it wrong. The draft and the biggest production verifier disagree with each other right now, and the standard behind both of them is further from finished than its own working group’s timeline says it should be.

The header format changed under signers’ feet

Web Bot Auth authenticates HTTP requests with a cryptographic signature and a Signature-Agent header pointing to the signer’s public-key directory. Early drafts defined that header as a bare string: Signature-Agent: "https://example.com". On 2026-10-20, revision -04 of the architecture draft changed the format to a Structured Fields dictionary — Signature-Agent: sig1="https://example.com". On 2026-07-29, the current protocol draft went further and made the dictionary form mandatory: “Signers MUST send the dictionary form,” with the bare-string form kept readable only for backward compatibility.

Cloudflare verifies more Web Bot Auth traffic than anyone else, and its live integration docs say the opposite. Under “Failed message validation,” the current Cloudflare Web Bot Auth documentation lists, verbatim: “The message uses the dictionary form from later drafts, such as sig2="https://signature-agent.test"” as a rejection reason, and requires the header to be “a structured string, not a dictionary.” A signer that follows the newest draft to the letter — the one telling implementers they MUST send the dictionary form — gets a failed verification from Cloudflare. AgentReady’s own crawler signs with the bare-string form for exactly this reason: it’s what the verifier that actually sits in front of most of the web still accepts.

The standard isn’t as settled as “Best Current Practice by August 31” sounds

The IETF’s webbotauth working group charter sets three deliverable dates: standards-track documents for authentication and for conveying bot information, both due 2026-04-30, and a Best Current Practice operational document due 2026-08-31. As of this week, none of the three has landed. The documents doing the actual work — the authentication protocol and the key-directory registry — are still individual submissions (draft-meunier-webbotauth-httpsig-protocol-02, draft-meunier-webbotauth-registry-03), not draft-ietf- documents the working group has formally adopted. Their own source repository describes itself as “the working area for individual Internet-Drafts” — adoption, and the standards-track deadline it was tied to, is already four months overdue. With no adopted document to build a BCP from, the August 31 milestone reads the same way.

None of this makes Web Bot Auth vaporware — Cloudflare, AWS, Akamai and others verify it in production today, ahead of any ratified standard. It means the wire format is still moving under a spec that production infrastructure already depends on, and the safe move for a merchant or platform implementing it is to match what your verifier actually accepts, not the newest revision of a document nobody has adopted yet.

What to do about it right now

  • If you sign outbound agent or crawler requests, send the bare-string Signature-Agent form until Cloudflare’s docs say otherwise — check the Failed message validation section before you change anything.
  • If you verify inbound signatures yourself, don’t hard-fail on the bare-string form; production signers are sending it deliberately.
  • Re-check both the draft text and Cloudflare’s docs after 2026-08-31 — either the BCP milestone slips again, which is itself worth knowing, or it lands and settles which form wins.

FAQ

Why does my Web Bot Auth signature fail even though it matches the latest spec text?

Because “latest spec text” and “what the verifier checks” are two different documents right now. The current protocol draft requires the dictionary form of Signature-Agent, but Cloudflare’s live verification docs explicitly reject that form and require the older bare-string form instead.

Is Web Bot Auth an IETF standard yet?

No. Its working group’s charter set standards-track deadlines of 2026-04-30 and a Best Current Practice deadline of 2026-08-31, but as of this week none of the working documents carry the draft-ietf- prefix that marks formal working-group adoption — they remain individual submissions.

Should I hold off implementing Web Bot Auth until the spec settles?

No — implement against what your verifier actually accepts today (the bare-string Signature-Agent form for Cloudflare) and revisit after the standard stabilizes. Production infrastructure is already verifying signatures ahead of ratification, so waiting for a finished RFC means missing traffic that’s authenticating itself right now.

Sources

Sign what your verifier accepts, not what the newest draft asks for — that’s the same instinct AgentReady’s audit applies to every other machine-readable surface a store depends on.