AI agent detection

AI agent detection lets you identify authorized AI agents visiting your website and distinguish them from malicious bots. It uses Web Bot Auth, a cryptographic signing protocol, to verify agent identity. When Fingerprint detects an agent, it returns structured metadata, including the agent’s provider, name, and the identity verification status in the bot_info field of the Server API response. This lets you make precise access decisions: allow authorized agents, block unverified automation, or apply different logic based on agent category and provider.

​

How verification works

1. The agent signs its HTTP requests using a private key.
2. Fingerprint retrieves the agent’s public key from a directory hosted at a known URL.
3. Fingerprint verifies the signature and returns an identity value in bot_info.

The identity value reflects the outcome of the verification:

​

API response

When Fingerprint detects a bot or agent, the Server API response includes the following fields: The bot_info object contains: bot_info is available in Server API v4 and only when Fingerprint recognizes the agent or bot. See the Server API reference for the full schema.

​

Supported AI agents

The following agents are currently detected and return bot_info metadata: For the full list of all detectable bots and agents, see the Bot Directory.

​

Using detection results

The bot field (good, bad, not_detected) is a legacy signal. For AI agents and other recognized bots, use bot_info.identity instead, as it provides more precise, actionable information. Note that identity is only available for well-known bots and agents in the Bot Directory. Some generic browser automation tools (Selenium, Playwright, headless Chrome, etc.) will not have a bot_info entry and should be handled using the bot: bad signal.

​

Next steps