Bot directory
ChatGPT agent: what it is, how to verify it, and how to block it
ChatGPT agent is OpenAI's AI agent.
| Vendor | OpenAI |
|---|---|
| What it is for | AI agent |
| In its Signature-Agent header | https://chatgpt.com |
| Verified by | Web Bot Auth signature |
| Its key directory | https://chatgpt.com/.well-known/http-message-signatures-directory |
| By default | Let through |
It browses and acts for a person, booking a table or filling a cart, and signs each request with its vendor's key. Bot Protection lets it through by default; you can block it.
How to verify it
ChatGPT agent sends a browser's User-Agent, which any bot can copy. A request is ChatGPT agent only when it carries a Web Bot Auth signature that verifies with a key OpenAI publishes in its key directory: check the signature, not the name.
How to block it
Bot Protection verifies ChatGPT agent by its signature on every request and answers it as you choose on the Set-up page, per kind or for ChatGPT agent alone; a request whose signature does not verify is judged like any other visitor.