{
  "slug": "web-bot-auth-vs-human",
  "title": "Web Bot Auth tells you which bot. Not whose human.",
  "summary": "Web Bot Auth (RFC 9421, adopted by Visa, Mastercard, Shopify, Vercel) verifies which agent sent a request. It says nothing about whether a human authorized it. Different problems.",
  "lede": "Web Bot Auth is becoming the standard way to verify agent traffic cryptographically \u2014 RFC 9421 HTTP Message Signatures, adopted by Visa TAP, Mastercard Agent Pay, Shopify, and Vercel. It answers \u2018which agent is this?\u2019 with certainty. It says nothing about whether a human authorized what the agent is doing. Those are two different problems, and you need both.",
  "date": "2026-06-15",
  "reading_time": "4 min read",
  "category": "Standards",
  "tags": [
    "Web Bot Auth",
    "RFC 9421",
    "agent identity",
    "standards",
    "verification"
  ],
  "image": "https://cdn.twc.sh/images/igcache/Web%20Bot%20Auth%20vs%20Human/1200_630/blog.jpg",
  "url": "/blog/web-bot-auth-vs-human.html",
  "wordcount": 439,
  "related": [
    "ap2-human-presence-gap",
    "agent-chargeback-liability",
    "oauth-to-agentauth"
  ],
  "schema": "Article"
}