Repository navigation
docs: Clarify opt-in WBA access and improve discovery #627
+62
−40
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,27 +1,47 @@ | ||
| --- | ||
| title: "Web Bot Auth (WBA)" | ||
| description: "Use Web Bot Auth (WBA) to give your agents a verifiable identity. Request KERNEL’s opt-in WBA token on Startup and Enterprise plans." | ||
| --- | ||
|
|
||
| [Web Bot Auth (WBA)](https://datatracker.ietf.org/doc/html/draft-meunier-web-bot-auth-architecture) lets your browser agent cryptographically sign requests so participating websites can verify its identity. Sites that recognize and allow that identity can let your agent continue with fewer bot challenges and interruptions. | ||
|
|
||
| We offer **KERNEL's WBA token** as an **opt-in feature**, enabled selectively on request for **Startup Plan and Enterprise Plan customers**. It's not enabled by default. | ||
|
There was a problem hiding this comment. Plan details in page introLow Severity The frontmatter   Triggered by learned rule: Keep page descriptions and intros high-level — push details into subsections Reviewed by Cursor Bugbot for commit 01a39b5. Configure here. |
||
|
|
||
| ## Request WBA access | ||
|
|
||
| To request access, [contact support](mailto:support@kernel.sh) with your use case and the websites you want to access. We review requests and enable the feature selectively; being on an eligible plan doesn't automatically turn it on. | ||
|
|
||
| With KERNEL's WBA token, you can sign requests using one of our bot identities instead of registering your own identity. KERNEL is listed in [Vercel's public directory](https://bots.fyi/d/kernel) and [Cloudflare's bots and agents directory](https://radar.cloudflare.com/bots/directory/kernel). See [Bots and agents](/bots) for our identities and their public key directories. | ||
|
|
||
|  | ||
|
|
||
| ### Why use WBA? | ||
|
|
||
| WBA gives participating sites a verifiable identity they can use when deciding whether to allow your agent. For workflows interrupted by bot checks, this can mean fewer challenges, fewer retries, and less time spent handling blocked requests on sites that accept the identity. | ||
|
|
||
| WBA complements [stealth mode](/browsers/bot-detection/stealth) and [proxies](/proxies/overview). Those features address browser and network signals; WBA adds cryptographic identity that a site can verify. | ||
|
|
||
| <Note> | ||
| WBA verifies the signing identity. Each website still decides whether to allow its requests. WBA doesn't guarantee access to every site or replace user login, permissions, or site rate limits. | ||
| </Note> | ||
|
|
||
| ## How it works | ||
|
|
||
| WBA uses HTTP message signatures to identify the signer of a request. The extension in the examples below adds cryptographic signature headers to outgoing HTTP requests: | ||
|
|
||
| - **`Signature`**: The RFC 9421 signature of the request | ||
| - **`Signature-Input`**: Metadata about how the signature was created | ||
| - **`Signature-Agent`**: URL that points to your key directory | ||
|
|
||
| Platforms like [Vercel](https://bots.fyi/) or other hosting providers can verify these signatures against your public key, confirming the signing identity before applying their access policies. | ||
|
|
||
| ## Quick start with test key | ||
|
|
||
| To try WBA signature verification, build an extension with the test key and visit the [test verification site](https://http-message-signatures-example.research.cloudflare.com/). | ||
|
|
||
| <Info> | ||
| This example uses a public test key. It doesn't enable KERNEL's WBA token or establish a production identity. To use our identity, [request access](#request-wba-access). | ||
| </Info> | ||
|
|
||
| ### 1. Build the extension | ||
|
|
||
|
|
@@ -96,7 +116,7 @@ This site validates requests signed with the RFC9421 test key and shows whether | |
|
|
||
| ## Using your own keys | ||
|
|
||
| If you want to sign production requests with your own identity, use your own signing keys and publish a public key directory. This is an alternative to requesting KERNEL's WBA token. | ||
|
|
||
| ### 1. Generate an Ed25519 key pair | ||
|
|
||
|
|
@@ -149,15 +169,7 @@ kernel extensions build-web-bot-auth \ | |
| --upload my-web-bot-auth | ||
| ``` | ||
|
|
||
| ### 4. Register with WBA-aware directories (optional) | ||
|
|
||
| If you want Vercel-protected sites to recognize your agent, you can register your key directory with [Vercel](https://bots.fyi/new-bot). Kernel is officially listed in the Vercel directory. | ||
|
|
||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
WBA access policy duplicated
Low Severity
The overview and stealth pages restate WBA opt-in rules, plan eligibility, and access caveats instead of briefly pointing to the canonical
Request WBA accesssection. Those details can drift if the request process changes.Additional Locations (1)
browsers/bot-detection/stealth.mdx#L13-L16Triggered by learned rule: Single source of truth — no deep content duplication across pages
Reviewed by Cursor Bugbot for commit 9397bfb. Configure here.