---
title: Cryptographically verifiable probes (Web Bot Auth)
description: Anyone can put "WatchFor" in a User-Agent header, so allowlisting our checks by name was never really safe. Every HTTP and API check now carries an Ed25519…
canonical: https://watchfor.io/changelog/2026-08-28-verifiable-probes
---

[All updates](/changelog/page/6#2026-08-28-verifiable-probes) ✨ New Aug 28, 2026 · v 6.2.0

# Cryptographically verifiable probes (Web Bot Auth)

Anyone can put "WatchFor" in a User-Agent header, so allowlisting our checks by name was never really safe. Every HTTP and API check now carries an Ed25519 signature (RFC 9421 HTTP message signatures, Web Bot Auth profile), and anyone receiving a request that claims to be a WatchFor probe can verify it against our published keys at /.well-known/http-message-signatures-directory. Together with per-probe reverse DNS under *.probe.watchfor.io, that makes our probes verifiable end to end; details at /bot.

## What changed

Every HTTP and API check now carries three extra headers: Signature-Agent , Signature-Input and Signature . Together they form an Ed25519 signature over the request, following RFC 9421 HTTP message signatures and the Web Bot Auth profile. Only WatchFor holds the private key. The public keys are published at /.well-known/http-message-signatures-directory .

## Why it matters

A fake bot can copy our User-Agent but not our signature. So a request that verifies against our published keys really came from a WatchFor probe. Bot-management services that support Web Bot Auth can let our checks through on that basis alone, which means fewer monitors failing on a bot challenge while your site is fine.

## An example

Your WAF blocks unknown bots, and you want to let WatchFor through without opening the door to everyone who types "WatchForBot" into a script. You add a rule that allows requests whose Web Bot Auth signature verifies for watchfor.io . A scraper sending our User-Agent from its own server fails the check and stays blocked.

## Other ways to verify

Each probe's IP address also has matching forward and reverse DNS under *.probe.watchfor.io , and the full IP list is at [/ips.json](/ips.json). Everything is described on [/bot](/bot), and the [Cloudflare guide](/docs/reference/probe-locations) covers allowlisting step by step.

Share this update

---

Canonical page: https://watchfor.io/changelog/2026-08-28-verifiable-probes · Site guide: https://watchfor.io/llms.txt