A few weeks ago, we partnered with Vercel to begin supporting Web Bot Auth on Kernel, giving agents a cryptographic way to prove their identity on the internet. As part of this effort to provide agents with secure, reliable access to the internet, the question of Cloudflare came up. After all, Cloudflare does protect around 20 percent of all websites worldwide.
That’s why we’re excited to partner with Cloudflare to support the adoption of Web Bot Auth. Before I tell you more, though, let me explain what Web Bot Auth is (feel free to skip ahead if you already know it well).
What is Web Bot Auth?
Web Bot Auth began as an IETF proposal with the idea of enabling agents to sign every HTTP request using HTTP message signatures, with keys discoverable through a public directory. It’s quickly becoming the standard way for agents to establish identity. Think of it as a passport for agents. Hosting providers in front of websites act as border control, checking these passports.
How does it work on Kernel?
With this new partnership, we’re paving the way for agents built on Kernel to not get blocked by Cloudflare Turnstile on sites with default configurations. You can now use your own keys on Kernel to sign requests, or, very soon, rely on Kernel’s default keys—pre-approved by platforms like Cloudflare and Vercel—which they verify before passing your trusted requests through to the sites they host.
Behind the scenes, Web Bot Auth works via a Chrome extension on our cloud browsers that intercepts all outgoing HTTP requests and adds cryptographic signature headers:
- Signature: The RFC 9421 signature of the request
- Signature-Input: Metadata about how the signature was created
- Signature-Agent: URL that points to your key directory
Going beyond good bot vs bad bot
While Web Bot Auth solves the problem of identifying a “good bot,” it doesn’t solve the problem of accessing data behind logins and managing credentials. That’s why in the winter, we released a standardized way to let agents log in and stay logged in across the internet.
If you’re exploring the future of agent identity, we’d love to collaborate. Reach out to partnerships@kernel.sh. And if you want to learn more about how to get started with Web Bot Auth, check out our docs.
