# Web Bot Auth identity

> Every organization's browsers sign with their own key under the shared Signature-Agent, so sites can tell organizations apart by keyid.

Every browser of OpenWAF Browsers signs its requests with [Web Bot Auth](https://developers.openwaf.dev/browsers/web-bot-auth/) under the same `Signature-Agent`, `"https://browsers.openwaf.dev"`. Within that identity, each organization signs with **its own Ed25519 key**. The key's id, `keyid` (its RFC 7638 JWK thumbprint), is in the `Signature-Input` of every request the organization's browsers make.

## What a site sees

| Header field | Same for | Tells the site |
|---|---|---|
| `Signature-Agent` | Every customer | The request comes from a browser of OpenWAF Browsers. |
| `keyid` in `Signature-Input` | One organization | Requests with the same `keyid` come from the browsers of the same organization. |

So a site can recognise or allow OpenWAF Browsers as a whole by its `Signature-Agent`, and recognise, rate-limit or block one organization's browsers by its `keyid` without affecting the others.

A `keyid` is a key fingerprint, not an account name: OpenWAF does not publish which organization holds which key.

## The directory

Every key is in one directory:

```text
https://browsers.openwaf.dev/.well-known/http-message-signatures-directory
```

It lists the key of every approved organization, and the shared key that signed for every organization before per-organization keys, while it is still in use. The directory answer is signed with **every** key it lists (one signature per key, with the tag `http-message-signatures-directory`), so a verifier can check that each listed key belongs to `https://browsers.openwaf.dev`.

## Lifecycle of a key

- **Approval.** When an operator approves OpenWAF Browsers for an organization, its key is created and published in the directory. It warms up for about 10 minutes so that verifiers can fetch it before it is used; meanwhile the organization's browsers sign with the shared key. After that, the organization's key signs.
- **Rotation.** Only an OpenWAF operator rotates an organization's key, for example if it may have been exposed. An organization cannot rotate its own key: that would let it shed the blocks sites have set on its `keyid`. The new key warms up the same way. The current key keeps signing until the new one is active, then stays in the directory for about 10 more minutes and is removed.
- **Withdrawal.** When access is withdrawn, or the organization is suspended or deleted, its keys leave the directory at once. Sites behind OpenWAF stop accepting signatures made with them within about a minute.

Going over the monthly quota does not change the key: the browsers stop, and the key is the same when they come back.

## Find your keyid

- **Dashboard:** **Browsers → Overview**, card **Web Bot Auth identity**, with a copy button. Its state is *Warming up* (with the time it starts signing), *Active*, or *Rotating* while a rotation is in progress.
- **API:** the `wba` field of `GET /v1/orgs/{org}/browsers` (see the [overview](https://developers.openwaf.dev/browsers/reference/#overview)).
- **CLI:** `openwaf-cloud ctl browsers status`.

## Who verifies it

- **Sites behind OpenWAF.** AI Crawl Control verifies Web Bot Auth signatures against this directory as one of its [bot verification](https://developers.openwaf.dev/ai-crawl-control/verification/) methods. A key counts only while the directory answer carries a valid signature made with it.
- **Cloudflare** verifies Web Bot Auth signatures of the agents registered with it. It applies the same rule to the directory: it accepts a listed key only if the directory answer is signed with that key.
- **Any site** can verify the signatures itself with the steps in [verify it on your site](https://developers.openwaf.dev/browsers/web-bot-auth/#verify).

Turning Web Bot Auth off for a browser or as the organization's default removes the signature, and with it the `keyid`: see [turn it off](https://developers.openwaf.dev/browsers/web-bot-auth/#turn-it-off).