Beyond IP lists: a registry format for bots and agents

Cloudflare proposes an open registry and Signature-Agent card format to support Web Bot Auth, enabling websites to discover and validate cryptographic keys for bots and agents at scale. The approach moves identification from brittle IPs/User-Agent strings to verifiable signatures, supports curated registries (including Cloudflare Radar), and provides operational metadata (contacts, rate expectations) via an extended JWKS directory. Adoption examples include Amazon Bedrock AgentCore and a Caddy server demo, aiming to foster interoperable, portable configurations and a broader ecosystem of trusted bot authentication.