Beyond IP lists: a registry format for bots and agents

Cloudflare outlines a registry format for bots and agents as a scalable way to discover cryptographically signed requests, expanding beyond traditional IP lists and robots.txt. The post explains that as bots begin cryptographically signing their requests, operators need a simple way to retrieve each agent’s public key material, hence the registry of Signature-Agent keys.

It notes that such registries can be authored and imported easily and that anyone can host them on public file systems or services, with Cloudflare providing one of the first examples through Radar. The piece also describes a companion Signature-Agent Card format to attach metadata about agents, similar to a modern contact card, and gives a concrete JSON example illustrating fields like client_name, contacts, and keys.

It mentions Amazon Bedrock AgentCore and its AgentCore Browser as adopters of Web Bot Auth, and that Cloudflare’s own registry is available for trusted bots via Radar. This approach aims to shift trust from brittle identifiers to verifiable cryptographic authentication while fostering an open ecosystem for curation.