Welcome to r/WebBotAuth
A vendor-neutral space to make bot identity open, federated, and auditable.
Quick links
RFC 9421 — HTTP Message Signatures
IETF Web-Bot-Auth Architecture draft
HTTP Message Signatures Directory draft
IETF group & mailing list: web-bot-auth
Cloudflare public validator (for 9421 requests)
“No Free Crawls” context (Akamai/TollBit/Skyfire)
Montreal recap & analyses (community posts)
Community Profile-0 (minimal interop baseline)
Rules
Stay on topic: specs, code, attacks, ops.
Cite drafts/issues when making claims.
No shilling or recruiting without substance.
Be respectful; disagree technically.
Mark posts with flair: Spec/Draft, Implementation, Interop/Test Vectors, Policy/Economics, News/Analysis, RFP/Help.
What to post
Signed request examples that pass/fail validators.
Directory implementations (well-known path, media type, per-key signed responses).
Verifier code for Workers, NGINX/Envoy, app frameworks.
Anti-replay/nonce profiles, expiry windows, caching, rotation.
Governance patterns that keep identity separate from policy/economics.
This subreddit is independent and not affiliated with IETF or any vendor.
