Checking whether
an agent is who it claims
Check signatures or published IP ranges before applying a separate agent policy.
Decision trace
ExampleAI agents
- Input signalsGPTBot user agent, from an address in the published OpenAI range.
- Reason idsNo agent_spoofed reason.
agent.verified: true. - DecisionYour configured agent policy: allow, limit, shadow or block.
- What to doApply the returned decision and grant. The user-agent claim on its own proves nothing.
How it works
Forward the request
Send the real user agent, end-user IP and original signature headers from your backend.
Check the identity
Ed25519 Web Bot Auth or a published operator IP range verifies supported identities.
Set agent policy
Use the site-wide agent policy or a rule matching a verified agent name.
API
Example request and response. Keep the secret on your backend.
POST https://nolgard.com/v1/verify
Content-Type: application/json
{
"secret": "SITE_SECRET",
"token": "BROWSER_TOKEN",
"remoteIp": "END_USER_IP",
"headers": { "user-agent": "GPTBot" }
}
// Example response fields: matching published range
{
"agent": {
"name": "GPTBot", "operator": "openai.com",
"verified": true, "method": "ip-range"
}
}Limits
- A user-agent string alone never verifies an agent. Missing or not-yet-loaded ranges leave the identity unverified; a known-range mismatch adds
agent_spoofed. - Web Bot Auth requires the original authority and signature, signature-input and signature-agent headers. Invalid signatures add
agent_signature_invalid. - Trusted signature hosts currently include chatgpt.com and you.com. A valid signature from another host identifies that host but does not make it trusted.
- IP verification covers the published operators in the shipped directory, which does not include every AI agent. Unrecognized agents follow ordinary scoring.
- Verified means identity only; it is never permission. Default agent policy is block; choose the behavior your product needs.