From 01a39b553fb986ecbbc177beafd3931e181a4b68 Mon Sep 17 00:00:00 2001 From: AnnaXWang <6621137+AnnaXWang@users.noreply.github.com> Date: Thu, 24 Sep 2026 17:59:42 +0000 Subject: [PATCH 1/2] docs: Explain opt-in WBA access and improve discovery --- browsers/bot-detection/overview.mdx | 6 ++++ browsers/bot-detection/stealth.mdx | 4 +++ browsers/bot-detection/web-bot-auth.mdx | 48 +++++++++++++++---------- docs.json | 44 +++++++++++------------ 4 files changed, 62 insertions(+), 40 deletions(-) diff --git a/browsers/bot-detection/overview.mdx b/browsers/bot-detection/overview.mdx index 1c58286f..b55c1c98 100644 --- a/browsers/bot-detection/overview.mdx +++ b/browsers/bot-detection/overview.mdx @@ -1,5 +1,6 @@ --- title: "Overview" +description: "Help your browser agents access websites with anti-detection defaults, stealth mode, proxies, and opt-in Web Bot Auth (WBA)." --- Automating the web as a browser agent is hard. @@ -30,6 +31,11 @@ Every Kernel browser launches with anti-detection chrome configuration applied. ### [Stealth Mode](/browsers/bot-detection/stealth) On top of the defaults, stealth mode adds a default ISP proxy and an automatic CAPTCHA solver. Both are opt-out so you can BYO proxy and/or CAPTCHA tooling. +### [Web Bot Auth (WBA)](/browsers/bot-detection/web-bot-auth) +WBA lets your agent sign requests with a verifiable identity. Participating websites that recognize and allow that identity can reduce bot challenges and interruptions in your workflows. + +**KERNEL's WBA token is opt-in**, enabled selectively on request for **Startup Plan and Enterprise Plan customers**. It's not enabled by default. [Request WBA access](/browsers/bot-detection/web-bot-auth#request-wba-access) to use our bot identity. Each site still controls access; WBA doesn't replace login or guarantee that a site will allow your agent. + ### [Config Registry](/config-registry) Kernel recommended browser and proxy configurations for websites. diff --git a/browsers/bot-detection/stealth.mdx b/browsers/bot-detection/stealth.mdx index 673d3de0..23fefebf 100644 --- a/browsers/bot-detection/stealth.mdx +++ b/browsers/bot-detection/stealth.mdx @@ -11,6 +11,10 @@ Enabling `stealth` mode adds two managed services on top: Both are opt-out so you can [bring your own](#bring-your-own-proxy-or-captcha-solver) where it makes sense. + +[Web Bot Auth (WBA)](/browsers/bot-detection/web-bot-auth) adds a verifiable signing identity that participating sites can recognize and allow. KERNEL's WBA token is a separate opt-in feature, enabled selectively on request for Startup Plan and Enterprise Plan customers. Enabling stealth mode alone doesn't opt you in. [Request WBA access](/browsers/bot-detection/web-bot-auth#request-wba-access). + + ### IP Rotation Behavior The default stealth proxy provides a **static exit IP** — all connections within the session exit through the same IP address. If you override the default with a [residential proxy](/proxies/residential), exit IPs will rotate per connection. See [Residential IP Rotation Behavior](/proxies/residential#ip-rotation-behavior) for details. diff --git a/browsers/bot-detection/web-bot-auth.mdx b/browsers/bot-detection/web-bot-auth.mdx index 301ece3c..82161891 100644 --- a/browsers/bot-detection/web-bot-auth.mdx +++ b/browsers/bot-detection/web-bot-auth.mdx @@ -1,27 +1,47 @@ --- -title: "Web Bot Auth" -description: "Cryptographically sign browser requests with Web Bot Auth" +title: "Web Bot Auth (WBA)" +description: "Use Web Bot Auth (WBA) to give your agents a verifiable identity. Request KERNEL’s opt-in WBA token on Startup and Enterprise plans." --- -[Web Bot Auth](https://datatracker.ietf.org/doc/html/draft-meunier-web-bot-auth-architecture) is quickly becoming the standard way for agents to establish identity. That's why we've partnered with [Vercel](https://bots.fyi/d/kernel) and [Cloudflare](https://radar.cloudflare.com/bots/directory/kernel) to support Web Bot Auth on Kernel. +[Web Bot Auth (WBA)](https://datatracker.ietf.org/doc/html/draft-meunier-web-bot-auth-architecture) lets your browser agent cryptographically sign requests so participating websites can verify its identity. Sites that recognize and allow that identity can let your agent continue with fewer bot challenges and interruptions. -![Kernel on Vercel's public directory of known bots used across the web](/images/botsfyi.png) +We offer **KERNEL's WBA token** as an **opt-in feature**, enabled selectively on request for **Startup Plan and Enterprise Plan customers**. It's not enabled by default. -You can now cryptographically sign browser requests, so your agents can prove who they are to services like Vercel. +## Request WBA access + +To request access, [contact support](mailto:support@kernel.sh) with your use case and the websites you want to automate. We review requests and enable the feature selectively; being on an eligible plan doesn't automatically turn it on. + +With KERNEL's WBA token, you can sign requests using one of our bot identities instead of registering your own identity. KERNEL is listed in [Vercel's public directory](https://bots.fyi/d/kernel) and [Cloudflare's bots and agents directory](https://radar.cloudflare.com/bots/directory/kernel). See [Bots and agents](/bots) for our identities and their public key directories. + +![KERNEL on Vercel's public directory of known bots used across the web](/images/botsfyi.png) + +### Why use WBA? + +WBA gives participating sites a verifiable identity they can use when deciding whether to allow your agent. For workflows interrupted by bot checks, this can mean fewer challenges, fewer retries, and less time spent handling blocked requests on sites that accept the identity. + +WBA complements [stealth mode](/browsers/bot-detection/stealth) and [proxies](/proxies/overview). Those features address browser and network signals; WBA adds cryptographic identity that a site can verify. + + +WBA verifies the signing identity. Each website still decides whether to allow its requests. WBA doesn't guarantee access to every site or replace user login, permissions, or site rate limits. + ## How it works -Web Bot Auth works via a Chrome extension that intercepts all outgoing HTTP requests and adds cryptographic signature headers: +WBA uses HTTP message signatures to identify the signer of a request. The extension in the examples below adds cryptographic signature headers to outgoing HTTP requests: - **`Signature`**: The RFC 9421 signature of the request - **`Signature-Input`**: Metadata about how the signature was created - **`Signature-Agent`**: URL that points to your key directory -Platforms like [Vercel](https://bots.fyi/) or other hosting providers can verify these signatures against your public key, confirming that the request came from your authenticated agent. +Platforms like [Vercel](https://bots.fyi/) or other hosting providers can verify these signatures against your public key, confirming the signing identity before applying their access policies. ## Quick start with test key -The fastest way to get started is using a test key, which works with this [test verification site](https://http-message-signatures-example.research.cloudflare.com/). +To try WBA signature verification, build an extension with the test key and visit the [test verification site](https://http-message-signatures-example.research.cloudflare.com/). + + +This example uses a public test key. It doesn't enable KERNEL's WBA token or establish a production identity. To use our identity, [request access](#request-wba-access). + ### 1. Build the extension @@ -96,7 +116,7 @@ This site validates requests signed with the RFC9421 test key and shows whether ## Using your own keys -For production use, you'll want to use your own signing keys instead of the test key. +If you want to sign production requests with your own identity, use your own signing keys and publish a public key directory. This is an alternative to requesting KERNEL's WBA token. ### 1. Generate an Ed25519 key pair @@ -149,15 +169,7 @@ kernel extensions build-web-bot-auth \ --upload my-web-bot-auth ``` -### 4. Using Kernel's bot identities - -Kernel's own Web Bot Auth identities are already approved by Cloudflare, Vercel, -Akamai, and other bot-verification providers. If you want to sign requests with -one of Kernel's identities rather than your own, [contact Kernel support](https://www.kernel.sh/docs/info/support). -See [Bots and agents](/bots) for the list of identities and their key -directories. - -### 5. Register with Vercel and other Web Bot Auth-aware directories (optional) +### 4. Register with WBA-aware directories (optional) If you want Vercel-protected sites to recognize your agent, you can register your key directory with [Vercel](https://bots.fyi/new-bot). Kernel is officially listed in the Vercel directory. diff --git a/docs.json b/docs.json index b5cfbe00..05f225ef 100644 --- a/docs.json +++ b/docs.json @@ -145,6 +145,28 @@ "group": "Intermediate", "expanded": true, "pages": [ + { + "group": "Bot Anti-Detection", + "pages": [ + "browsers/bot-detection/overview", + "browsers/bot-detection/stealth", + "browsers/bot-detection/hcaptcha", + { + "group": "Proxies", + "pages": [ + "proxies/overview", + "proxies/custom", + "proxies/residential", + "proxies/mobile", + "proxies/isp", + "proxies/datacenter", + "proxies/errors" + ] + }, + "browsers/bot-detection/web-bot-auth", + "bots" + ] + }, { "group": "Auth", "pages": [ @@ -201,28 +223,6 @@ "group": "Advanced", "expanded": true, "pages": [ - { - "group": "Bot Anti-Detection", - "pages": [ - "browsers/bot-detection/overview", - "browsers/bot-detection/stealth", - "browsers/bot-detection/hcaptcha", - { - "group": "Proxies", - "pages": [ - "proxies/overview", - "proxies/custom", - "proxies/residential", - "proxies/mobile", - "proxies/isp", - "proxies/datacenter", - "proxies/errors" - ] - }, - "browsers/bot-detection/web-bot-auth", - "bots" - ] - }, "browsers/extensions", "browsers/private-networking", "browsers/chrome-policies", From 69e885e805072e4d3148d0cae65a98d422a5a2dd Mon Sep 17 00:00:00 2001 From: Anna Wang Date: Fri, 25 Sep 2026 09:24:24 -0700 Subject: [PATCH 2/2] Apply suggestion from @dprevoznik Co-authored-by: Daniel Prevoznik --- browsers/bot-detection/web-bot-auth.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/browsers/bot-detection/web-bot-auth.mdx b/browsers/bot-detection/web-bot-auth.mdx index 82161891..1796ae4b 100644 --- a/browsers/bot-detection/web-bot-auth.mdx +++ b/browsers/bot-detection/web-bot-auth.mdx @@ -9,7 +9,7 @@ We offer **KERNEL's WBA token** as an **opt-in feature**, enabled selectively on ## Request WBA access -To request access, [contact support](mailto:support@kernel.sh) with your use case and the websites you want to automate. We review requests and enable the feature selectively; being on an eligible plan doesn't automatically turn it on. +To request access, [contact support](mailto:support@kernel.sh) with your use case and the websites you want to access. We review requests and enable the feature selectively; being on an eligible plan doesn't automatically turn it on. With KERNEL's WBA token, you can sign requests using one of our bot identities instead of registering your own identity. KERNEL is listed in [Vercel's public directory](https://bots.fyi/d/kernel) and [Cloudflare's bots and agents directory](https://radar.cloudflare.com/bots/directory/kernel). See [Bots and agents](/bots) for our identities and their public key directories.