# A Web Bot Auth key per organization in OpenWAF Browsers

> Each organization's browsers now sign with their own key under the shared Signature-Agent, so sites can rate-limit or block one organization by keyid.

Every browser of OpenWAF Browsers kept the same `Signature-Agent`, `"https://browsers.openwaf.dev"`, but until now they all signed with one key. Now each organization signs with **its own Ed25519 key** from the same directory, so a site can recognise, rate-limit or block one organization's browsers by the `keyid` in `Signature-Input` without affecting other customers. The `keyid` names no organization.

- Approval publishes the organization's key. It warms up for about 10 minutes, while the browsers sign with the shared key, and then it signs.
- Only an OpenWAF operator rotates an organization's key; an organization cannot shed the blocks set on its `keyid`.
- Withdrawing access removes the organization's keys from the directory at once, and sites behind OpenWAF stop accepting them within about a minute.
- The directory answer is signed with every key it lists, so each key can be checked as belonging to `https://browsers.openwaf.dev`.

Organizations approved before today get their key automatically. Your `keyid` is in **Browsers → Overview** in the dashboard and in the `wba` field of `GET /v1/orgs/{org}/browsers`. See [Web Bot Auth identity](https://developers.openwaf.dev/browsers/identity/).