Developer Hub

Implement Web Bot Auth with RFC 9421 HTTP Message Signatures. SDKs for Express, Next.js, FastAPI, Flask, WordPress, and Docker.

Full Documentation GitHub

What are you building?

I'm a Publisher

Verify incoming bot requests

I'm a Crawler

Sign my HTTP requests

For Publishers

Verify bot requests

Add bot verification to your application. Choose your stack.

Option A: WordPress Plugin

Recommended

One-click install. Includes analytics dashboard, llms.txt, and per-post policies.

Install from WordPress.org

1. Go to Plugins → Add New
2. Search "OpenBotAuth"
3. Click Install Now
4. Click Activate

Or visit: wordpress.org/plugins/openbotauth

WordPress.org Documentation →

Option B: Zero-Code Proxy

No code changes. Run a reverse proxy in front of your app.

npx (no install)

npx @openbotauth/proxy

# or with Docker
docker run -p 8088:8088 -e UPSTREAM_URL=http://localhost:3000 \
  ghcr.io/openbotauth/openbotauth-proxy

NPM

Option C: Node.js (Express / Next.js)

Drop-in middleware for Express and Next.js.

@openbotauth/verifier-client

npm install @openbotauth/verifier-client

import express from 'express';
import { openBotAuthMiddleware } from '@openbotauth/verifier-client/express';

const app = express();
app.use(openBotAuthMiddleware());

app.get('/api/content', (req, res) => {
  if (req.oba.signed && req.oba.result?.verified) {
    res.json({ content: 'Full content', agent: req.oba.result.agent });
  } else {
    res.json({ content: 'Preview only' });
  }
});

NPM

Option D: Python (FastAPI / Flask)

ASGI middleware for FastAPI, WSGI for Flask.

openbotauth-verifier

pip install openbotauth-verifier[fastapi]

from fastapi import FastAPI, Request
from openbotauth_verifier import OpenBotAuthASGIMiddleware

app = FastAPI()
app.add_middleware(OpenBotAuthASGIMiddleware)

@app.get('/api/content')
async def get_content(request: Request):
    if request.state.oba.signed and request.state.oba.result.verified:
        return {'content': 'Full content'}
    return {'content': 'Preview only'}

PyPI

For Crawlers

Sign your requests

Step 1: Register your crawler

Step 2: Sign requests

Use bot-cli to test signing, or integrate registry-signer into your code.

@openbotauth/bot-cli

# Generate Ed25519 keypair
oba-bot keygen --jwks-url https://api.openbotauth.org/jwks/mybot.json

# Fetch URL with signed request
oba-bot fetch https://example.com/api/content -v

Use in your code

@openbotauth/registry-signer

npm install @openbotauth/registry-signer

import { generateKeyPair, publicKeyToJWK } from '@openbotauth/registry-signer';

const { publicKey, privateKey } = generateKeyPair();
const jwk = publicKeyToJWK(publicKey, 'my-key-id', {
  alg: 'EdDSA'
});

NPM

Resulting signature headers

Signature-Input: sig1=("@method" "@path");keyid="my-key";alg="ed25519"
Signature: sig1=:K2qGT5srn2OGbOIDzQ6kYT+ruaycnDAAUpKv+ePFfD0=:
Signature-Agent: https://api.openbotauth.org/jwks/mybot.json