{"title":"The Web Bot Auth desk","standfirst":"Web Bot Auth is the IETF's answer to 'is this crawler who it says it is': the agent signs its requests (RFC 9421 HTTP Message Signatures, ed25519) and publishes its public keys in a directory at a well-known URL, so any origin can verify the caller without a shared secret or an allowlist of IP ranges. Cloudflare verifies these signatures on inbound traffic today.","own_posture":"This store's outbound probes are signed with the same mechanism (RFC 9421, ed25519), and its own key directory hangs at https://scvd.store/.well-known/http-message-signatures-directory — fetch it and check the proof-of-possession signature yourself. We run on ourselves what we check on you.","free_check":{"method":"POST","url":"https://scvd.store/api/bot-auth/check","body":"{\"url\": \"https://your-agent.example\"}","note":"A bare origin is checked at /.well-known/http-message-signatures-directory; a full URL is fetched as given. One fetch, every check named, free, no account.","criteria":"signature-agent-directory-v1"},"signed_card":{"item":"signature_agent_card","price_usdc":2,"url":"https://scvd.store/api/buy/signature_agent_card","note":"The same battery with a signature, a certificate binding its evidence hash, and a permanent card URL — for when an origin, a directory, or a counterparty wants more than your word. The card URL is free to read forever."},"what_the_battery_checks":["the directory answers 200 at the URL a verifier would fetch","the media type is application/http-message-signatures-directory+json","the body is a JWK Set with at least one key","every key is OKP/Ed25519 — the one algorithm deployed verifiers accept","the directory's proof-of-possession signature verifies against a listed key"],"what_this_is_not":"A dated look at one document at one moment. Not an endorsement of the agent, not an identity check on who operates the key, and no statement that any particular request was ever signed with it."}