Beyond IP lists- a registry format for bots and agents
Oct 30, 2025Thibault Meunier, Maxime Guerreiro
Summary
Introduces a registry format for bots and agents, extending the Web Bot Auth protocol. This format allows for the discovery of public keys by listing URLs to agent key directories. A complementary signature-agent card format is proposed to include metadata like client name, URI, logo, contacts, and expected crawl rate. Cloudflare will provide an initial registry instance, and a demo for Caddy server shows how to import registries. This addresses the problem of discovering public keys for bots and agents at scale, moving beyond IP lists and user agents to cryptographic authentication.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack