Web Bot Auth

Web Bot Auth is quickly becoming the standard way for agents to establish identity. That’s why we’ve partnered with Vercel and Cloudflare to support Web Bot Auth on Kernel. You can now cryptographically sign browser requests, so your agents can prove who they are to services like Vercel.

How it works

Web Bot Auth works via a Chrome extension that intercepts all outgoing HTTP requests and adds cryptographic signature headers:

Signature: The RFC 9421 signature of the request
Signature-Input: Metadata about how the signature was created
Signature-Agent: URL that points to your key directory

Platforms like Vercel or other hosting providers can verify these signatures against your public key, confirming that the request came from your authenticated agent.

Quick start with test key

The fastest way to get started is using a test key, which works with this test verification site.

1. Build the extension

Use the Kernel CLI to build the Web Bot Auth extension:

kernel extensions build-web-bot-auth --to ./web-bot-auth-ext --upload my-web-bot-auth

The build command requires Node.js and npm to be installed on your system.

2. Create a browser with the extension

# Create a browser with the web-bot-auth extension
kernel browsers create --extension my-web-bot-auth

# The command outputs the browser ID and live view URL
# Open the live view URL in your browser, then navigate to:
# https://http-message-signatures-example.research.cloudflare.com/

import { Kernel } from "@onkernel/sdk";
import { chromium } from "playwright";

const kernel = new Kernel();

// Create browser with web-bot-auth extension
const browser = await kernel.browsers.create({
  extensions: [{ name: "my-web-bot-auth" }],
});

// Connect via Playwright
const pw = await chromium.connectOverCDP(browser.browser_url);
const context = pw.contexts()[0];
const page = context?.pages()[0] || await context.newPage();

// Navigate to a page - requests will be automatically signed
await page.goto("https://http-message-signatures-example.research.cloudflare.com/");

from kernel import Kernel
from playwright.sync_api import sync_playwright

kernel = Kernel()

# Create browser with web-bot-auth extension
browser = kernel.browsers.create(extensions=[{"name": "my-web-bot-auth"}])

# Connect via Playwright
with sync_playwright() as p:
    pw = p.chromium.connect_over_cdp(browser.browser_url)
    context = pw.contexts[0]
    page = context.pages[0] if context.pages else context.new_page()

    # Navigate to a page - requests will be automatically signed
    page.goto("https://http-message-signatures-example.research.cloudflare.com/")

3. Verify it’s working

Navigate to the test site to verify your signatures are being accepted: This site validates requests signed with the RFC9421 test key and shows whether the signature was verified successfully.

Using your own keys

For production use, you’ll want to use your own signing keys instead of the test key.

1. Generate an Ed25519 key pair

Create a JWK file with your Ed25519 private key. The key must include both the public (x) and private (d) components:

my-key.jwk

{
  "kty": "OKP",
  "crv": "Ed25519",
  "x": "YOUR_PUBLIC_KEY_BASE64URL",
  "d": "YOUR_PRIVATE_KEY_BASE64URL"
}

See web-bot-auth documentation for tools to generate Ed25519 key pairs.

2. Host your public key

For websites to verify your signatures, you need to host your public key at a well-known URL. Create a key directory at:

https://yourdomain.com/.well-known/http-message-signatures-directory

The directory should contain your public keys in JWKS format:

{
  "keys": [
    {
      "kty": "OKP",
      "crv": "Ed25519",
      "x": "YOUR_PUBLIC_KEY_BASE64URL",
      "kid": "YOUR_KEY_ID"
    }
  ],
  "purpose": "your-bot-purpose"
}

3. Build with your key and hosted key directory

kernel extensions build-web-bot-auth \
  --to ./web-bot-auth-ext \
  --key ./my-key.jwk \
  --signature-agent https://yourdomain.com \
  --upload my-web-bot-auth

4. Using Kernel’s bot identities

Kernel’s own Web Bot Auth identities are already approved by Cloudflare, Vercel, Akamai, and other bot-verification providers. If you want to sign requests with one of Kernel’s identities rather than your own, contact Kernel support. See Bots and agents for the list of identities and their key directories.

5. Register with Vercel and other Web Bot Auth-aware directories (optional)

If you want Vercel-protected sites to recognize your agent, you can register your key directory with Vercel. Kernel is officially listed in the Vercel directory.

Overview

Working with your browser

Integrations

Migrations

deploying your agent

Agent Skills

Community

Info

How it works

Quick start with test key

1. Build the extension

2. Create a browser with the extension

3. Verify it’s working

Using your own keys

1. Generate an Ed25519 key pair

2. Host your public key

3. Build with your key and hosted key directory

4. Using Kernel’s bot identities

5. Register with Vercel and other Web Bot Auth-aware directories (optional)

References

​How it works

​Quick start with test key

​1. Build the extension

​2. Create a browser with the extension

​3. Verify it’s working

​Using your own keys

​1. Generate an Ed25519 key pair

​2. Host your public key

​3. Build with your key and hosted key directory

​4. Using Kernel’s bot identities

​5. Register with Vercel and other Web Bot Auth-aware directories (optional)

​References

How it works

Quick start with test key

1. Build the extension

2. Create a browser with the extension

3. Verify it’s working

Using your own keys

1. Generate an Ed25519 key pair

2. Host your public key

3. Build with your key and hosted key directory

4. Using Kernel’s bot identities

5. Register with Vercel and other Web Bot Auth-aware directories (optional)

References