AI Product Index / Web Bot Auth key directory

Web Bot Auth key directory

It lets you tell a real signed agent from anything that copied its user-agent string, and it lets callers verify your responses. The infrastructure side of agent traffic rather than the content side.

2
of 122 points
1.6%
of the total grade
2026
checklist generation

Does this apply to your site?

For sites supporting signed machine requests or responses. This is not a prerequisite for reading public content.

This score measures coverage of a published technical checklist. It does not measure AI visibility, referrals, content understanding or successful agent tasks. Optional service interfaces may not apply to your site; missing them still affects this fixed checklist.

How to address it when relevant

Publish Ed25519 keys at /.well-known/http-message-signatures-directory (RFC 9421 web-bot-auth) so callers can verify your responses, and so you can tell a signed agent from an anonymous scraper.

Check your own site

Free, no signup, same endpoint that produced every grade on the leaderboard:

curl "https://index.percall.dev/api/score?url=https://your-site.example"

It returns the letter grade and every check by name with pass/fail. The $0.05 call at POST /api/audit adds why each one failed and a snippet with your origin already in it.

The rest of the checklist

6 more 2026 checks, and 13 from the other generation.