The Signed-Agent-Metadata HTTP Header Field for Web Bot Auth (draft-vilgalys-webbotauth-signed-agent-metadata-00)
R. Vilgalys, P. Gonzalez
Standard body: IETF → (unit not yet charted)
Abstract
Web Bot Auth uses HTTP Message Signatures to let automated HTTP clients authenticate their identity to origins via the Signature- Agent header field. When a multi-tenant agent platform signs outbound requests with a shared key, all customer workloads on that platform share a single cryptographic identity. Abusive traffic from one tenant or workload can degrade the reputation of the entire platform and cause origins to block legitimate tenants. This document defines the Signed-Agent-Metadata HTTP header field, an RFC 9651 Dictionary that carries optional, pseudonymous per-request metadata (product, project, and session). By signing Signed-Agent- Metadata inside the Web Bot Auth signature, a platform enables verifiers to evaluate traffic, apply rate limits, and isolate reputation at a narrower scope than the signing origin.
Cite this entry
GB/T 7714-2015
R. Vilgalys, P. Gonzalez. The Signed-Agent-Metadata HTTP Header Field for Web Bot Auth (draft-vilgalys-webbotauth-signed-agent-metadata-00)[S/OL]. IETF Internet-Draft, Intended status: Standards Track (individual submission, Web Bot Auth, rev -00; Google), 2026(2026-11-02)[2026-11-13]. https://datatracker.ietf.org/doc/draft-vilgalys-webbotauth-signed-agent-metadata/.
BibTeX
@techreport{vilgalys2026,
author = {R. Vilgalys and P. Gonzalez},
title = {The Signed-Agent-Metadata HTTP Header Field for Web Bot Auth (draft-vilgalys-webbotauth-signed-agent-metadata-00)},
year = {2026},
organization = {IETF Internet-Draft, Intended status: Standards Track (individual submission, Web Bot Auth, rev -00; Google)},
howpublished = {\url{https://datatracker.ietf.org/doc/draft-vilgalys-webbotauth-signed-agent-metadata/}},
} This entry is part of the AgentNet Observer library. Attribute with a link to this page when quoting.