---
language: en
title: "Agents with verifiable signatures"
description: "Agents with verifiable signatures sign HTTP requests. Validation identifies a key and its association, but does not by itself authorize access or actions."
canonical: "https://tropk.ai/en/resources/glossary/agents-with-verifiable-signatures"
last_modified: "2026-10-12T16:11:08.930Z"
---

# Agents with verifiable signatures

Reviewed on 2026-10-06.

## What it means

Agents with verifiable signatures are automated clients that add a cryptographic signature to HTTP requests. The server verifies the signature using public material associated with the agent’s identifier. The result depends on the signed components and the validated association with the key; the name declared in the User-Agent alone does not provide this cryptographic proof.

## Why it matters for marketing

For marketing, signatures make it possible to request more verifiable identification before deciding how to handle automated traffic. This is useful when a partner queries business information and the team needs to distinguish its requests from imitations. Policy remains separate: recognizing the requester does not determine which pages, data, or operations it may access on the site.

## Example in practice

Imagine a distributor that allows a partner to query its public packaging catalog. Two requests show the same agent name, but only one has a signature validated with the key associated with the partner. The distributor decides to apply the catalog’s read-only rule only to the confirmed identity, without granting access to buyer records.

## How to implement or verify

For the packaging catalog, infrastructure should verify the association between the identifier and public key, the validation result, temporal validity, and which parts of the request are covered. Compare valid and invalid test requests according to the implementation in use. Then record the access decision separately; having signature headers does not mean verification has been completed.

## Important distinctions

The signature does not prove the stated business purpose, a buyer’s consent, or the delegation of authority by a person. It also does not replace compliance with [robots.txt](/en/resources/glossary/robots-txt) and applicable licenses. [Web Bot Auth](/en/resources/glossary/web-bot-auth) is a specific proposal for identifying this traffic; as of October 2026, its protocol remains an active draft in the IETF group.

## Sources and references

- [HTTP Message Signatures for automated traffic — draft-ietf-webbotauth-httpsig-protocol-00](<https://datatracker.ietf.org/doc/draft-ietf-webbotauth-httpsig-protocol/>) — IETF
- [Verified bots](<https://developers.cloudflare.com/bots/concepts/bot/verified-bots/>) — Cloudflare

## Continue a leitura

- [User agent](</en/resources/glossary/user-agent>)
- [Web Bot Auth](</en/resources/glossary/web-bot-auth>)
- [robots.txt](</en/resources/glossary/robots-txt>)

## About the author

[Vinicius Pacheco](</en/team/vinicius-pacheco>)

Responsible for Tropk’s technical content, focusing on crawling, indexing, structured data, and agent access to content.

---

[All pages in Markdown](<https://tropk.ai/sitemap.md>)