Web Bot Auth

August 25, 2026·2 min read

Web Bot Auth

When Falcata's own crawlers and background agents make outbound HTTP requests to third-party sites, they sign those requests. Any site that receives traffic claiming to be Falcata can verify the signature against a published key and confirm the request really came from Falcata, rather than from something spoofing the user agent or IP range.

Why this exists

Bot traffic is usually unverifiable — a User-Agent header is just a string anyone can send. Web Bot Auth gives a receiving site a way to check cryptographic proof of origin instead of trusting a header. Falcata signs its outbound requests so recipients don't have to take "this is Falcata" on faith.

This is one-directional: it covers requests Falcata sends out, not requests you send to Falcata. Furnace's own inbound API authentication is unrelated and documented at Authentication.

How the signature works

Falcata signs outbound requests following RFC 9421 (HTTP Message Signatures)(opens in a new tab) and the structured-field encoding from RFC 8941(opens in a new tab), using the IETF Web Bot Auth conventions on top. Each signed request carries three headers:

Header	Contents
`Signature-Agent`	The signer's identity — `"https://www.falcata.io"`
`Signature-Input`	Which components were signed, the signing key, and the `web-bot-auth` tag
`Signature`	The Ed25519 signature itself

The signing key is Ed25519. A recipient verifies the signature against Falcata's published public key rather than trusting the Signature-Agent header on its own.

Where the verification key lives

Falcata publishes a key directory a verifier can fetch to check these signatures at https://api.falcata.io/.well-known/http-message-signatures-directory. The directory is served as application/http-message-signatures-directory+json and contains a JSON Web Key Set under a keys array — standard JWK entries (Ed25519, so kty: "OKP", crv: "Ed25519") a verifier can use directly with any RFC 9421-compliant signature library.

Verifying a request from Falcata

Confirm the Signature-Agent header claims https://www.falcata.io.
Fetch Falcata's published key directory.
Verify the Signature header against the signed components named in Signature-Input, using the matching key from the directory.

If the signature checks out, the request genuinely came from Falcata's signing key — not merely from something presenting a matching User-Agent.