---
title: Verify NBT Bot traffic
canonical: https://nbt.bot/verify/
---

# Verify NBT Bot traffic

Anyone can copy a User-Agent. A valid Web Bot Auth signature is stronger proof that a direct crawler request came from NBT.

## Expected direct crawler identity

```text
User-Agent: NBTBot/1.0 (+https://nbt.bot/)
NBT-Scan-Id: <opaque run UUID>
Signature-Agent: "https://nbt.bot"
Signature-Input: nbt=(...)
Signature: nbt=:...:
```

Public Ed25519 verification keys: https://nbt.bot/.well-known/http-message-signatures-directory

During key rotation the directory may briefly contain both old and new public keys. Each published key has its own valid directory signature.

NBT does not claim Cloudflare Verified status until Cloudflare accepts the production BotBase submission and live verification succeeds.

Browser-based QA is separate. Cloudflare Browser Run can carry Cloudflare's own Web Bot Auth identity for that transport.