What is Web Bot Auth, and why does Shopify ask bots to sign?
30 October 2026
Web Bot Auth is a way for a bot or AI agent to prove which bot it is. It signs each request with a private key and publishes the matching public key at a fixed address on its own site, so the site it visits can check the signature instead of trusting the name the bot gives. Shopify asks bots and agents to sign this way. Since May 2026, those that do not sign get its strictest rate limits, and its checkout tools for agents tell their makers to sign.
How it works
- The bot's maker creates a key pair and publishes the public key at
/.well-known/http-message-signatures-directoryon its own domain. - Each request carries three headers:
Signature-Agent, where the public key is published;Signature-Input, what was signed and for how long; andSignature, the signature itself. - The site that receives the request fetches the public key and checks the signature. A valid one shows the request came from whoever holds that key.
It builds on HTTP Message Signatures (RFC 9421) and two IETF drafts, one for the key directory and one for how bots use it. Cloudflare's implementation guide walks through the steps.
What it adds is easiest to see beside the older ways a site tells bots apart:
| How a site tells bots apart | What it learns |
|---|---|
| The user-agent name | Only what the visitor claims; anyone can send any name |
A rule in robots.txt | Nothing about the visitor; it asks a named bot to stay out, and a bot may ignore it |
| A Web Bot Auth signature | That the request came from whoever holds the published key |
What Shopify does with it
- Since 7 May 2026, Shopify applies stricter rate limits to bots and agents on its storefronts. Those that do not sign get the strictest; signing qualifies for higher limits.
- Its checkout tools for browser agents, live since 28 September 2026, tell agent makers to sign with Web Bot Auth, say Shopify verifies only registered keys, and warn that unsigned requests might be deprioritized or blocked.
- Merchants can create signatures in the Shopify admin for their own crawlers and tools, such as SEO or accessibility audits. Each lasts at most three months.
What it means for your store
You do not need to do anything for agents to sign; Shopify checks signatures on its side. Two things are yours to decide. If your own audit or testing tool gets slowed or blocked on your store, give it a signature from the Shopify admin. If you want a bot kept out, a rule in robots.txt still asks it to stay away, and a signature is what lets a platform tell that bot from one using its name.
The AI shopping agents deciq sends to stores sign every request too. Where our public key is, and how to recognise a visit from us.
Questions
Is Web Bot Auth a standard?
It builds on HTTP Message Signatures, which is RFC 9421. The key directory and the way bots use it are still IETF drafts.
Does a signature let a bot through checkout?
Not by itself. Signatures merchants create in the Shopify admin do not open checkout, and Shopify's checkout tools for agents still submit an order only after the buyer confirms.
Do I need Cloudflare to use it?
No. Shopify points to Cloudflare's guide for context only and says you do not need to enroll with Cloudflare.
We built deciq to show you where AI shopping agents stop on your own store. Eight agents visit, each on a different shopper's errand, and the report shows where each one stopped and what to change.
Join the waitlist