AI agent authorization
Decide which AI agents may act on your site — by cryptographic identity, not by guessing.
What the problem actually is
An AI agent does not evade fraud detection. It passes it. It drives a real browser, so the fingerprint is real. It arrives on a residential connection, so the address is clean. It controls a real mailbox, so it receives the verification code. Every signal the industry has spent a decade building is a proxy for "is a human here", and an agent genuinely has the things those proxies measure. Detecting it is an arms race nobody wins. Meanwhile the volume is only going one way, and sites are left choosing between blocking all automation — which now means refusing customers whose assistants act for them — and allowing it, which means being farmed for trials, coupons and content.
Signals that carry the weight here
The only check here that proves rather than infers. The agent signs its request with a private key and we verify it against the key its operator publishes. There is no false-positive rate, because it is arithmetic rather than judgement.
The distinction nothing else can make. An operator's Signature Agent Card declares whether a request was initiated by a person or by autonomous scanning. Those are different events that every classical bot signal reports identically — and refusing the first one refuses your customer.
The card says what kind of automation this is; it cannot say how much. Someone can tell their assistant to open fifty trial accounts and it will honestly declare itself user-initiated every time. Fifty accounts sharing a device or a subnet is what gives that away.
Where to start
strictness=1 (balanced) — Start with the defaults and add rules only where you disagree with them. An empty policy already denies an unverifiable signature and refuses a self-declared crawler attempting to change state.
A defensible starting point, not a guarantee. Strictness moves the verdict thresholds only; the risk score itself never changes, so you can re-tune without re-scoring anything.
The call
curl -X POST "https://www.layercall.com/v1/agent/authorize" \
-H "X-Api-Key: YOUR_KEY" -H "Content-Type: application/json" \
-d '{
"method": "POST",
"url": "https://yoursite.com/signup",
"headers": { "signature": "$SIG", "signature-input": "$SIG_INPUT", "signature-agent": "$AGENT" }
}'
# → { "decision": "deny", "matched": "default:crawler_state_change",
# "reason": "… declares itself an autonomous crawler and is attempting POST." }1,000 lookups a month free, no card. Get an API key.
Questions
Can you detect an AI agent that does not identify itself?
Not reliably, and anyone claiming otherwise is selling you an arms race. A capable agent driving a real browser on a residential connection looks exactly like a person, because in every measurable respect it is behaving like one. What we can do is tell you, with certainty, when an agent DOES identify itself — and increasingly they do, because the operators want their traffic accepted. Unsigned automation then becomes conspicuous by omission rather than by detection.
Should I just block all AI agents?
That is the reflex, and it is getting more expensive every month. A growing share of legitimate traffic is somebody's assistant acting on their explicit instruction — booking, comparing, filling in a form they asked it to fill in. Blocking that is refusing a customer who is standing right there. The useful line is not human versus machine, it is whether a person asked for this request, which is exactly what the trigger field answers.
What if an agent lies about being user-initiated?
Then it is lying under a signature bound to its operator's identity, which is a reputational risk no serious operator wants and a fact you can act on. But the honest answer is that a truthful fetcher can still be abusive: a person really can instruct their assistant to farm fifty free trials. The card cannot see that and does not claim to. The linkage signals can, which is why we recommend using both rather than treating authorization as sufficient on its own.
Is this a standard, or your own invention?
A standard. Web Bot Auth is built on RFC 9421 HTTP Message Signatures, with an IETF working group chartered in early 2026 and Cloudflare, Google, Amazon and OpenAI behind it. The Signature Agent Card comes from the accompanying registry draft. We implement it; we did not invent it, and we would rather you could switch away from us than depend on something only we speak.
What happens when an agent publishes no card?
You get review, not a guess. We know who they are cryptographically and nothing about what they intend, and saying so is more useful than inventing a verdict. Most operators have not adopted the registry draft yet, so this is currently the common case for verified agents.