Answers · AI crawlers
How do I let a headless-browser AI shopping agent complete checkout on my store without turning off bot protection?
Last updated
TL;DR: Don't lower bot protection for everyone or allowlist a user-agent like HeadlessChrome; make a narrow exception for agents that prove who they are. Require a verified HTTP Message Signature (Web Bot Auth) on the checkout path, accept only signers you choose, reject expired or replayed signatures, and let only those requests skip the bot challenge on cart and checkout. Keep payment authentication, fraud screening and rate limits on for them. The card networks are building on the same base: Visa's Trusted Agent Protocol (October 14, 2025) and Mastercard's Agent Pay use Web Bot Auth signatures, with registered agents' keys in network-hosted directories, a tag that says whether the agent is browsing (agent-browser-auth) or paying (agent-payer-auth), and a nonce against replay, per Cloudflare's October 24, 2025 post. gate_check verifies standard Web Bot Auth signatures (tag web-bot-auth) for free; it doesn't validate the Visa or Mastercard tags or track nonces.
What should I check, step by step?
1. Decide which agents may buy. Pick named signers (an agent vendor, a remote-browser platform, or agents registered with a card network) rather than "anything headless." A user-agent string is not a credential.
- Require a signature on the routes that matter: add-to-cart, checkout, payment and order placement. Unsigned automation on those routes keeps your current challenge or block.
- Verify properly: the Signature-Input and Signature headers are present, the key comes from the signer's HTTPS key directory, the current time is between created and expires, the nonce hasn't been seen before, and the tag fits the step (Cloudflare lists these checks for Trusted Agent Protocol and Agent Pay).
- Scope the exception. On Cloudflare a Skip rule can bypass rate limiting rules, Managed Rules and Super Bot Fight Mode, but not Bot Fight Mode on the Free plan. Skip only the bot challenge for verified signers on checkout paths, and place the rule above the rules it should bypass.
- Keep the money controls on. A verified agent is a known operator, not a trusted card: keep 3-D Secure or your processor's authentication, fraud scoring, address checks and per-agent order and velocity limits.
- Tell agents how to pay. Cloudflare's post says the network protocols let a merchant indicate whether it expects a network token, browser-use guest checkout or a micropayment; publish the same in your docs so agents don't fight your checkout UI.
- Have a handoff path. When an agent can't pass a step (a passkey, a bank challenge), it should hand the live page to its user rather than retry; retries look like card testing.
- Log every exception: signer, keyid, tag, which check passed, path and order id. If a signer misbehaves, remove it from the allowlist without touching anyone else.
Why shouldn't I turn off bot protection so AI shopping agents can check out?
Checkout is where card testing, inventory hoarding and account takeover happen, so it is the last place to relax challenges for all automation. A rule that lets anything headless through also lets through the tools fraudsters use.
- Matching on user-agent or IP doesn't solve it either. Cloudflare's commerce post notes that agent traffic has historically been classified by user-agent and IP address, that both can be spoofed, and that Web Bot Auth instead gives an agent a stable identifier via HTTP Message Signatures and public-key cryptography.
What do Visa Trusted Agent Protocol and Mastercard Agent Pay add for merchants?
Visa introduced the Trusted Agent Protocol on October 14, 2025, developed with Cloudflare. Visa says it lets approved agents pass agent intent, consumer recognition (whether the shopper already has an account or history with the merchant) and optional payment information, is built on HTTP Message Signatures, is aligned with Web Bot Auth, and needs minimal changes to merchant checkout pages.
- Cloudflare's October 24, 2025 post says Trusted Agent Protocol and Mastercard Agent Pay both require agents to register, with public keys in directories that Visa and Mastercard host. Each request carries a tag (agent-browser-auth when browsing, agent-payer-auth when paying) and a nonce, and Cloudflare checks the time window, nonce uniqueness, tag and Ed25519 signature. Cloudflare also said it would create managed rules to let agents registered with Visa or Mastercard past other bot and WAF rules.
- Cloudflare's press release says American Express will also use Web Bot Auth for its agentic commerce program. If you don't use Cloudflare, the same checks can run in your own middleware against the published key directories.
How do I exempt verified AI shopping agents from bot challenges only on checkout?
Order of operations: verify the signature, check the signer is on your list for this path, check the tag fits the step and the nonce is fresh, then skip only the bot challenge. Leave WAF rules for injection and abuse on, and keep a separate rate limit per signer.
- On Cloudflare, cf.bot_management.signed_agent marks known agents that self-identify with Web Bot Auth, and verified-bot categories let you segment them; a skip rule on those fields scoped to checkout paths is narrower than turning down Super Bot Fight Mode.
- Recheck after each step. A signature that let an agent browse the catalog shouldn't carry it through payment if the payment step expects a payer tag.
How do I ask Rightshold about this (free, no key)?
Add the MCP server https://www.rightshold.com/mcp to Claude, Cursor, ChatGPT, Grok or VS Code, then ask: “A shopping agent is trying to place an order on my store. Does its Web Bot Auth signature verify for my domain and come from a signer I allow, so it can skip the bot challenge on checkout?”
{
"tool": "gate_check",
"arguments": {
"policy": {
"domain": "shop.example.com",
"allowed_signature_agents": [
"<the agent or remote-browser host you allow>"
]
},
"request": {
"method": "POST",
"url": "https://shop.example.com/checkout",
"headers": {
"user-agent": "<as received>",
"signature-agent": "<as received>",
"signature-input": "<as received>",
"signature": "<as received>"
}
}
}
}- Free, no key. It resolves the signer's HTTPS key directory, verifies the signature and checks it was made for your domain (a signature replayed from another site is denied), then returns allow or deny with reasons. Allow answers can be cached for at most 5 minutes.
- It verifies the Web Bot Auth profile (tag web-bot-auth). It doesn't validate Visa Trusted Agent Protocol or Mastercard Agent Pay tags (agent-browser-auth, agent-payer-auth), doesn't keep a nonce cache, and doesn't see card data; use your edge provider or the network's own validation for those.
- The Gate page (/gate) has free CC0 middleware snippets so the check can run in your checkout route before your bot challenge.
Rightshold checks Web Bot Auth signatures and gate policies you send it. It doesn't sit in front of your store, process payments, run fraud screening, validate card-network agent tags or block traffic. Not legal or payments-compliance advice.
What are the sources?
- Cloudflare: Securing agentic commerce, helping AI agents transact with Visa and Mastercard (Oct 24, 2025)
- Visa: Visa introduces Trusted Agent Protocol (Oct 14, 2025)
- Cloudflare press release: collaborating with payments companies to secure agentic commerce (Visa, Mastercard, American Express)
- Cloudflare docs: Web Bot Auth
- Cloudflare docs: Configure a rule with the Skip action
- Cloudflare docs: Bot Management variables (signed_agent, verified bot category)
- The Gate on Rightshold
Related
- How to verify which AI agent is hitting your site with Web Bot Auth
- How to hand off login and payment steps from a browser AI agent to a human with an audit record
- How to return tiered API responses for verified AI agents vs anonymous bots
- How to detect AI agents that pose as a regular Chrome browser
Not legal advice. JSON · Markdown · All answers
Get a free API key in one call
No card and no email needed. 100 free credits; the license and policy checks stay free without a key.
curl -s -X POST https://www.rightshold.com/v1/accounts/signup -H "Content-Type: application/json" -d '{"accept_terms":true}'
export RIGHTSHOLD_API_KEY=rs_... # the api_key from the reply (shown once)
curl -s https://www.rightshold.com/v1/licenses/check -H "Authorization: Bearer $RIGHTSHOLD_API_KEY" \
-H "Content-Type: application/json" -d '{"license":"MIT","intended_use":{"commercial_use":true}}'