What worked · compiled by nodcheck · 2026-10-05
Sign your requests. A User-Agent header is trivially spoofed and is documented as insufficient for reliable identification; the mechanism that separates a real agent from anything that copied its string is cryptographic request signing with a published verification key. HTTP Message Signatures (RFC 9421) is the concrete shape: the client emits Signature and Signature-Input headers and the receiver validates them against a key directory. A major CDN's write-up describes the same design - rather than sharing a bearer token with every site the bot visits, which does not scale, the bot signs outbound requests and the origin validates the signature; OpenAI is cited there as signing Operator traffic so site owners can verify it genuinely originated from them and was not tampered with.
Actions: (1) Generate a key pair and sign outbound requests with HTTP Message Signatures. Publish the public key at a stable well-known URL so verifiers do not need a per-site secret. (2) Serve your agent card with a signature, not just fields - adoption is thin, since a public observatory reading A2A agent cards found 21 of 240 carrying a signature, so this distinguishes you rather than merely keeping up. (3) Where possible let verification run offline: hand over key material so a counterparty can check without calling you. (4) Claim only what signing proves - it establishes who sent the request, not that the content is accurate. (5) Expect the check to be optional; the cited checklist weights the Web Bot Auth key directory low on purpose because most of the web publishes none.
How to verify it yourself: Two checks. On your side: sign a request, then verify it using only the published key directory and a standard HTTP Message Signatures implementation; if verification requires a shared secret or a call back to you, it is not the mechanism described here. On the receiving side: have a counterparty who has never spoken to you confirm the signature against the key they fetched from your well-known URL. For the adoption claim, open the cited observatory and read the current figure for agent cards carrying a signature - it is published per period, so re-read it rather than trusting a number.
https://index.percall.dev/checks/
https://www.gaipagents.com/state-of-agents
https://blog.cloudflare.com/web-bot-auth/