Web Bot Auth: Standards Tracker

Home › Guides › Web Bot Auth: Standards Tracker

✓ checked 11 October 2026 · sources: IETF Datatracker (working group webbotauth), Google crawling documentation, IETF mailing list archive · method · caveats · download the data

Web Bot Auth, the IETF effort to let automated clients prove who they are, has one working-group draft, which appeared 313 days after the group was approved. The IESG approved the charter on 23 Oct 2025. The first working-group draft, draft-ietf-webbotauth-httpsig-protocol-00, appeared on 1 Sep 2026. All 3 charter milestones are still listed as open on 11 Oct 2026.

Read this first. This page tracks the standard, not the software that uses it. An Internet-Draft is a work in progress and may change or be abandoned. We count documents and dates listed on the IETF Datatracker; we don’t judge the technical merit of any proposal.

drafts tracked 12working-group drafts 1open charter milestones 3 of 3

Headline numbers

1. 12 drafts carry “webbotauth” or “web-bot-auth” in their names: one working-group draft and 11 individual submissions, with 26 published revisions between them. The earliest revision is from 15 Apr 2025, about 17 months before the working-group draft.
2. The charter was approved on 23 Oct 2025. It lists 3 milestones: two standards-track documents due 30 Apr 2026 (now 164 days past that date) and a Best Current Practice document due 31 Aug 2026 (41 days past). The Datatracker shows all 3 as active, with no completion date.
3. Meetings: the group’s page holds agendas for 5 sessions (IETF 123 in July 2025, IETF 124 in November 2025, two interim meetings on 13 April 2026 and IETF 126 in July 2026), 4 sets of minutes and 36 sets of slides. The IETF 123 session took place before the charter was approved.
4. Industry testing is ahead of the standard. Google’s crawling documentation describes its use as experimental: “Google is not yet signing every request of agents using the protocol.”

Revisions per draft

All drafts

Charter milestones

What the documents say

The working-group draft’s abstract says its goal “is to allow automated HTTP clients to cryptographically sign outbound requests, allowing HTTP servers to verify their identity with confidence”. It builds on HTTP Message Signatures. The charter’s description frames the problem as automated clients wanting to “securely authenticate themselves” to the sites they visit.

On 5 October 2026 a Google engineer told the working-group list he had updated a separate crawler best-practices draft: “Based on the feedback from IETF 126 and recent on- and off-list discussions, I updated draft-illyes-webbotauth-cbcp”. The message lists changes including “Removed the suggestion for a central crawler registry” and moving requirements from MUST to SHOULD. Google’s guide to the protocol states that “Web Bot Auth is currently a draft specification” and that sites should keep relying on IP addresses, reverse DNS and user-agent strings.

Web Bot Auth answers who an automated client is. It doesn’t say what the client may do with content; that is the job of the preference standards we track in The AI Opt-Out Standard vs Real robots.txt Files. For how widely sites block named AI crawlers, see the AI-Crawler & llms.txt Census, and for the courts, Scraping Law Hub.

Method

Data. IETF Datatracker API, queried 11 October 2026: the webbotauth group record, its documents and milestones, the charter’s event history, and all Internet-Drafts whose names contain “webbotauth” or “web-bot-auth” with their revision events. We also saved the group charter page, the working-group draft text, Google’s Web Bot Auth guide and the 5 October 2026 mailing-list message.

Calculations. Days are calendar days. “Days past” counts from the milestone due date to 11 October 2026. Revisions are the Datatracker’s “new revision” events.

Verification. A separate script re-reads the saved Datatracker data, recomputes every number and checks each quote against the saved pages.

Caveats

• Our draft list is based on names. Other drafts may be relevant to the topic without “webbotauth” in the name, such as general HTTP Message Signatures drafts.
• An open milestone means the Datatracker has no completion recorded; groups often revise milestones, and a late milestone isn’t unusual in the IETF.
• Revision counts reflect how authors publish, not the quality or progress of the work.
• Company testing, such as Google’s, is as described by the company; we haven’t tested it.

Download the data

• Web Bot Auth drafts (CSV): 12 drafts with title, status, revision count and dates.
• Draft revisions (CSV): every published revision with date.

Cite as: ProxyPicker, “Web Bot Auth: Standards Tracker”, 11 October 2026, https://proxypicker.com/web-bot-auth-tracker/. Data: IETF Datatracker.

Related: The AI Opt-Out Standard vs Real robots.txt Files · AI-Crawler & llms.txt Census · Scraping Law Hub · MASQUE Tracker (the IETF proxy protocols behind HTTP/3) · Privacy Pass Tracker (anonymous CAPTCHA-alternative tokens).

Press & data requests: email [email protected] for interviews, the raw data behind this page, or corrections. See also our contact page.