Web Bot Auth (RFC 9421): the agent identifies itself at the HTTP layer
Web Bot Auth uses HTTP Message Signatures per RFC 9421: an agent signs every request with its key and points to a directory where the key is published. Networks such as Cloudflare and Visa's Trusted Agent Protocol thus recognise it as a registered agent.
Transport, not authority
Web Bot Auth answers who is asking — not whether this person authorised the action. It complements the mandate but does not replace it: recognition at the door, the mandate at the counter.
At Mandact
The SDK wraps fetch (withWebBotAuth) and signs every request with the agent's Ed25519 key; the signature directory points to the organisation at Mandact. Optionally the mandate token travels in the same request.
What the merchant gains
An agent that identifies itself at the transport layer and presents a verifiable mandate can be told apart from a scraper — and from an agent without authority.
Status
SDK function withWebBotAuth; use in Cloudflare/TAP environments documented (docs/WEB-BOT-AUTH.md).