Vercel & Kernel: Web Bot Auth for AI agents on the internet

For AI agents to be really useful, they need secure access to the internet. But today, most websites can’t tell the difference between a “good bot” and a “bad bot.” That’s why we’re excited to partner with Vercel to support the adoption of Web Bot Auth.

What is Web Bot Auth?

Web Bot Auth began as an IETF proposal with the idea of enabling agents to sign every HTTP request using HTTP message signatures, with keys discoverable through a public directory. It’s quickly becoming the standard way for agents to establish identity.

Think of it as a passport for agents. Hosting providers in front of websites act as border control, checking these passports. You can either use your own keys on Kernel to sign requests, or, soon, rely on Kernel’s default keys, which services like Vercel verify before passing your trusted requests through to the sites they host.

Web Bot Auth-aware directories

Public Web Bot Auth directories are starting to pop up at these major hosting providers that already sit in front of a huge portion of the internet. Vercel and others use these directories to look up your agent’s public key, verify the signature on each request, and only allow verified agents to bypass bot filters.

We’re already listed in Vercel’s directory as of today, and our registration with several others are currently pending approval.

Going beyond good bot vs bad bot

While Web Bot Auth solves the problem of identifying a “good bot,” it doesn’t solve the problem of accessing data behind logins and managing credentials. That’s why in the winter, we released a private beta of a standardized way to let agents log in and stay logged in across the internet. We’ll have more to share soon.

In the meantime, if you’re exploring the future of agent identity, we’d love to collaborate. Reach out to partnerships@kernel.sh. And if you want to learn more about how to get started with Web Bot Auth, checkout out our docs.