Cloudflare Just Reinvented My Agent Identity Layer — and That's a Relief
Last week I read Cloudflare’s web-bot-auth announcement and felt a strange mix of vindication and vertigo. In June I built an agent coordination layer on Bitcoin SV — signed keys, machine-to-machine handshakes, escrow and policy on a ledger. And here was Cloudflare shipping the same instinct on plain old HTTP.
This post is me learning in public. I’m not an authority on RFC 9421, and I won’t pretend to be. What I have is a private, BSV-flavored implementation of the exact problem Cloudflare just standardized, and a rare chance to compare them honestly.
The Problem We Both Saw
Agents browse the web like humans now. And the two signals sites use to trust a “good bot” — the User-Agent header and IP ranges — are both broken.
A User-Agent string is one line anyone can fake. IP ranges shift as infrastructure changes and hide multiple services behind one address. Neither answers the real question: who is this agent, provably?
Cloudflare’s Answer: Sign the Request
Cloudflare’s proposal is elegant because it steals from a standard that already works: RFC 9421 HTTP Message Signatures. The agent signs the target origin with its key before sending the request.
The headers tell the story:
| Header | Job |
|---|---|
Signature-Input |
Validity window (created/expires) + key ID
(JWK thumbprint) |
Signature |
The actual Ed25519 signature |
Signature-Agent |
Where to find the agent’s public keys (a directory) |
The key detail is the directory — a
/.well-known endpoint where an agent publishes its public
keys, so any origin can verify a signature without a pre-shared secret.
That’s the part that matters. It means an agent can prove who it is to a
site it’s never met.
What I Built on BSV: The Same Instinct, Different Substrate
Here’s the vertigo. My BSV agent coordination layer does the same dance, but with identity anchored to a ledger instead of a key directory.
One honest note, since this is a learning-in-public post: the name nods to the paperclip maximizer — and to paperclip.ing, the agent-management app that inspired the concept. The code itself is original Clojure on BSV, written in a focused June sprint. Not a fork — and, like everything on this blog, built by directing coding agents: I designed the architecture, drove the implementation, and reviewed what shipped.
Both systems ask the same question — can you prove you are who you claim, without me trusting you up front? — but they answer it with different primitives:
| Cloudflare web-bot-auth | My BSV layer | |
|---|---|---|
| Identity primitive | Ed25519 + JWK thumbprint | secp256k1 (ECDSA) |
| Key discovery | /.well-known directory |
Ledger-anchored (OP_RETURN) |
| Transport | HTTP headers (RFC 9421) | M2M protocol + signed packages |
| Verification | Origin validates signature | Peer verifies handshake |
| Extras | — | Escrow, payments, policy engine |
The Sharpest Difference: Passports vs. Authority Grants
Reading the commentary around this, I found a framing that cuts deeper than the implementation details. Karl McGuinness, ex-Okta chief product architect, put it like this:
“Agents do not need identity passports telling the world who they are. They need authority grants telling the world what they can do.”
That’s the difference between authentication and authorization, and it’s where web-bot-auth stops and the hard part begins.
web-bot-auth solves the passport. It does not solve the authority grant — what an agent may do right now, in this context, for this task, revoked when the task ends. That’s the frontier, and it’s where I want my BSV layer to actually go.
Where Both Still Fail
This is the honest part of learning in public: I don’t have answers to these, and neither does anyone else yet.
Multi-hop delegation. If my master agent spawns a scraper, who authorized what down the chain — without leaking credentials at each hop? My BSV anchoring gives me a hash trail, but reconstructing intent from hashes is unsolved.
Credential zero. An agent needs some boot token to talk to its own control plane before it earns task permissions. Bootstrap trust is the chicken-and-egg nobody has closed cleanly.
Machine-speed revocation. If a sub-agent hits a loop or a prompt injection, you have to kill its ephemeral tokens across every environment, instantly. That’s privileged-access-management break-glass discipline, applied at agent speed — and it’s where my CyberArk instincts meet my BSV code.
What I Actually Learned
Cloudflare standardizing RFC 9421 for agents is not competition. It’s confirmation that the problem I picked is real, important, and live right now. The standards are still being argued inside the IETF this month — which means a self-taught person can still read the drafts, run the demos, and have an opinion that matters.
The difference between us isn’t that one of us was right. It’s that they have a standards body and I have a ledger. I intend to keep building the ledger side — and now I have a public standard to argue with instead of a private hunch.
The holy-fuck realization, one more time: IAM/PAM looked boring because I was standing at the bottom of the stack. The top — agent identity — is being invented right now, and I’ve already got skin in the game.