The bot signs each request per RFC 9421 with an Ed25519 or other asymmetric key, using the tag web-bot-auth, short created and expires times and a keyid that is the key's JWK thumbprint. A Signature-Agent header points to an HTTPS directory (/.well-known/http-message-signatures-directory) where verifiers fetch the operator's public keys. HMAC is not allowed.
The protocol is being standardized in the IETF webbotauth working group (draft-ietf-webbotauth-httpsig-protocol, an Internet-Draft from September 2026, building on Cloudflare's earlier drafts). Cloudflare and other CDNs verify these signatures for site operators. The Web Bot Auth checker verifies a signed request and its key directory.