Vercel's bot verification now supports Web Bot Auth
By Steven Van ·
Vercel's Bot Protection now verifies automated traffic like ChatGPT operator via signed HTTP Message Signatures, not just IP and DNS checks.
Vercel's bot verification now supports Web Bot Auth, an IETF proposal built with industry partners that uses HTTP Message Signatures (RFC 9421) to verify automated traffic through public-key cryptography in signed headers. Bot Protection already checked bots by IP address and reverse DNS; Web Bot Auth adds a third method that proves a request's authenticity regardless of where it originates, which the announcement notes suits bots running in dynamic or serverless environments.
Verified bots using Web Bot Auth send signed headers with each request, so they're recognized and let through Bot Protection and Challenge Mode. ChatGPT operator is cited as an example: it signs its requests with Web Bot Auth and is now allowed through.
Details are in Vercel's bot management documentation.