Web Bot Auth, Google’s new experimental method to validate authentic bots

Google is trying a new method of bot authentication named Web Bot Auth. Google posted a new help document that explains that Web Bot Auth is a “new cryptographic protocol that helps websites to validate that bots are authentic.”
The goal of Web Bot Auth is to help you automate the process of authenticating which AI Agent bots are authentic and which are fraud.
Limited test. Google said the search compan is “testing the protocol with some AI agents hosted on Google infrastructure.” Not all Google user agents are using Web Bot Auth and Google is not yet signing every request of agents using the protocol.
Thus Google recommends that in addition to Web Bot Auth you continue relying on IP addresses, reverse DNS, and user-agent strings as Google gradually rolls out signed traffic.
What is Web Bot Auth. Google defined Web Bot Auth as “Web Bot Auth is an experimental cryptographic protocol used to authenticate requests sent by bots. Instead of relying solely on self-reported headers and IP addresses, Web Bot Auth allows agents to cryptographically sign their requests.”
Web Bot Auth can bring the following benefits according to Google:
- Future-proofing: Help establish a web where agent providers and websites can build mutual trust and make informed access decisions.
- Cryptographic certainty: Move beyond easily spoofed headers to a verified identity and decouple agent identity from IP addresses.
- Better observability: Gain clearer insights into how agents interact with your content.
Why we care. As AI Agents become more and more common across the web, managing which Agents can access your site and web pages may become more and more of a challenge. This new method of authentication may help you allow authentic AI Agents and block the inauthentic AI Agents.
Again, this is an “experimental” feature right now, so keep track of its progress.




