Skip to content
1 minute readNewAgent-ready

Buying agents that sign their requests are recorded as verified

An agent that signs its UCP quote or checkout requests with Web Bot Auth is now checked against its published keys and recorded as a verified buyer, with no token to fetch first.

The API reference for a UCP quote, saying a verified Web Bot Auth signature records the buying agent as verified.

An agent that signs its requests with Web Bot Auth is now checked against its published keys and recorded as a verified buyer.

  • Sign the request. Send Signature-Agent, Signature-Input and Signature (HTTP Message Signatures with an Ed25519 key, tagged web-bot-auth) on a UCP quote or checkout. A valid signature records the buying agent with source: "web_bot_auth" and verified: true.
  • Named by your domain. The agent is named by the host that publishes its key directory, and the key's keyid is kept as its subject.
  • Failures refuse nothing. If the signature does not verify, the purchase goes ahead with the agent recorded as unverified.
  • Usage. Calls from signed agents count under buyer_agent=verified, alongside agents that send an AgentID token.