Every browser of OpenWAF Browsers signs its requests with Web Bot Auth under the same Signature-Agent, "https://browsers.openwaf.dev". Within that identity, each organization signs with its own Ed25519 key. The key's id, keyid (its RFC 7638 JWK thumbprint), is in the Signature-Input of every request the organization's browsers make.
What a site sees
| Header field | Same for | Tells the site |
|---|---|---|
Signature-Agent | Every customer | The request comes from a browser of OpenWAF Browsers. |
keyid in Signature-Input | One organization | Requests with the same keyid come from the browsers of the same organization. |
So a site can recognise or allow OpenWAF Browsers as a whole by its Signature-Agent, and recognise, rate-limit or block one organization's browsers by its keyid without affecting the others.
A keyid is a key fingerprint, not an account name: OpenWAF does not publish which organization holds which key.
The directory
Every key is in one directory:
https://browsers.openwaf.dev/.well-known/http-message-signatures-directoryIt lists the key of every approved organization, and the shared key that signed for every organization before per-organization keys, while it is still in use. The directory answer is signed with every key it lists (one signature per key, with the tag http-message-signatures-directory), so a verifier can check that each listed key belongs to https://browsers.openwaf.dev.
Lifecycle of a key
- Approval. When an operator approves OpenWAF Browsers for an organization, its key is created and published in the directory. It warms up for about 10 minutes so that verifiers can fetch it before it is used; meanwhile the organization's browsers sign with the shared key. After that, the organization's key signs.
- Rotation. Only an OpenWAF operator rotates an organization's key, for example if it may have been exposed. An organization cannot rotate its own key: that would let it shed the blocks sites have set on its
keyid. The new key warms up the same way. The current key keeps signing until the new one is active, then stays in the directory for about 10 more minutes and is removed. - Withdrawal. When access is withdrawn, or the organization is suspended or deleted, its keys leave the directory at once. Sites behind OpenWAF stop accepting signatures made with them within about a minute.
Going over the monthly quota does not change the key: the browsers stop, and the key is the same when they come back.
Find your keyid
- Dashboard: Browsers → Overview, card Web Bot Auth identity, with a copy button. Its state is Warming up (with the time it starts signing), Active, or Rotating while a rotation is in progress.
- API: the
wbafield ofGET /v1/orgs/{org}/browsers(see the overview). - CLI:
openwaf-cloud ctl browsers status.
Who verifies it
- Sites behind OpenWAF. AI Crawl Control verifies Web Bot Auth signatures against this directory as one of its bot verification methods. A key counts only while the directory answer carries a valid signature made with it.
- Cloudflare verifies Web Bot Auth signatures of the agents registered with it. It applies the same rule to the directory: it accepts a listed key only if the directory answer is signed with that key.
- Any site can verify the signatures itself with the steps in verify it on your site.
Turning Web Bot Auth off for a browser or as the organization's default removes the signature, and with it the keyid: see turn it off.