AI Product Index / Web Bot Auth key directory

Web Bot Auth key directory

It lets you tell a real signed agent from anything that copied its user-agent string, and it lets callers verify your responses. The infrastructure side of agent traffic rather than the content side.

2
of 122 points
1.6%
of the total grade
2026
checklist generation

How to pass it

Publish Ed25519 keys at /.well-known/http-message-signatures-directory (RFC 9421 web-bot-auth) so callers can verify your responses, and so you can tell a signed agent from an anonymous scraper.

Check your own site

Free, no signup, same endpoint that produced every grade on the leaderboard:

curl "https://index.percall.dev/api/score?url=https://your-site.example"

It returns the letter grade and every check by name with pass/fail. The $0.05 call at POST /api/audit adds why each one failed and a snippet with your origin already in it.

The rest of the checklist

6 more 2026 checks, and 13 from the other generation.