Web Bot Auth tells you which bot. Not whose human.
Web Bot Auth is becoming the standard way to verify agent traffic cryptographically — RFC 9421 HTTP Message Signatures, adopted by Visa TAP, Mastercard Agent Pay, Shopify, and Vercel. It answers ‘which agent is this?’ with certainty. It says nothing about whether a human authorized what the agent is doing. Those are two different problems, and you need both.
What Web Bot Auth does
Instead of trusting a spoofable User-Agent header, Web Bot Auth has the agent sign its HTTP requests with a private key and publish the public key at a /.well-known directory. The receiving site verifies the signature. It's clean, it's standards-track (RFC 9421), and it's already adopted across Cloudflare, the card networks, Shopify, and Vercel. If you operate or receive agent traffic, it's the right way to establish which agent is calling.
The distinction that matters
Web Bot Auth authenticates the agent's identity. That's genuinely useful — it tells you this really is the agent it claims to be, not an impersonator. But "this is really AcmeAgent" is not "a human authorized AcmeAgent to do this specific thing." A correctly-signed request from a legitimately-identified agent can still be an action no human approved — a hijacked agent, an over-broad script, an agent acting outside its remit. Verifying the sender is not verifying the authorization.
Compose the two layers
Don't replace Web Bot Auth — ride it. The agent's request carries its Web Bot Auth signature (proving the agent) and a delegation receipt (proving a human authorized this scope). Same request, one more signature. Now the receiving party knows both which agent is calling and whose human stands behind it, with an offline-verifiable record of each. Agent identity plus human authorization is the complete picture; either alone is half of it.
Honest limits
This needs both layers present and a relying party that checks for the delegation receipt, not just the agent signature — and the ecosystem is early. But the layering is clean precisely because the two standards answer different questions and don't overlap.
Frequently asked questions
If an agent's request is cryptographically signed, isn't that enough? It proves which agent sent it — not that a human authorized the action. A hijacked or over-broad agent signs valid requests too. You need the human-authorization layer alongside it.
Does this replace Web Bot Auth? No — it composes with it. Web Bot Auth proves the agent; a delegation receipt proves the human behind the scope. They sit in the same request.
Who needs to check the receipt? The relying party — the site, API, or merchant receiving the agent request — verifies both the agent signature and the human-authorization receipt offline.
Knowing which bot is calling is not the same as knowing a human told it to call. Verify both, or you've verified nothing that matters.