Every browser of OpenWAF Browsers kept the same Signature-Agent, "https://browsers.openwaf.dev", but until now they all signed with one key. Now each organization signs with its own Ed25519 key from the same directory, so a site can recognise, rate-limit or block one organization's browsers by the keyid in Signature-Input without affecting other customers. The keyid names no organization.
- Approval publishes the organization's key. It warms up for about 10 minutes, while the browsers sign with the shared key, and then it signs.
- Only an OpenWAF operator rotates an organization's key; an organization cannot shed the blocks set on its
keyid. - Withdrawing access removes the organization's keys from the directory at once, and sites behind OpenWAF stop accepting them within about a minute.
- The directory answer is signed with every key it lists, so each key can be checked as belonging to
https://browsers.openwaf.dev.
Organizations approved before today get their key automatically. Your keyid is in Browsers → Overview in the dashboard and in the wba field of GET /v1/orgs/{org}/browsers. See Web Bot Auth identity.