Feature
Verify AI agents with Web Bot Auth and RFC 9421 signatures.
Wayleave verifies Ed25519 HTTP Message Signatures against key directories you trust. A valid signature puts the request in the verified_agent lane; an invalid one is treated as the strongest fraud signal there is.
What gets verified
- Real Ed25519 over an RFC 9421 signature base.
- Forged keys, tampered requests, expired signatures and replay-farming windows are rejected.
- Signature parameters parsed as an RFC 9421 dictionary; alg enforced as Ed25519; any signature label.
- Requests signed in Cloudflare's documented Web Bot Auth format verify.
- Optional nonces make a signature single-use.
Key directories
Pass your own directory or resolver, or use directories: 'wayleave:default' to fetch a signed directory on a timer and resolve from memory.
Verify signed agents
curl -X POST https://api.wayleave.dev/v1/identify \
-H "Authorization: Bearer $WAYLEAVE_API_KEY" \
-H "Content-Type: application/json" \
-d '{"method":"GET","url":"https://api.yourapp.com/v1/data",
"headers":{"user-agent":"...","signature":"...","signature-input":"..."}}'
{ "lane": "verified_agent", "verified": true,
"identity": { "keyid": "k1", "operator": "Example Labs" } }Questions
Is this the same as Cloudflare Web Bot Auth?
Wayleave implements RFC 9421 HTTP Message Signatures with Ed25519 and verifies requests signed in Cloudflare's documented Web Bot Auth format.