Agent Identity Verification
Agent identity verification refers to methods by which an automated client proves to a service which provider operates it and on whose behalf it acts. Common mechanisms are signed requests, short-lived tokens and delegation credentials.
Agent identity verification is the cryptographic proof of whose behalf an AI agent acts when calling a website or API. It replaces guesswork based on user-agent strings and IP ranges.
Explanation
As agentic traffic grows, classic bot detection no longer suffices: an agent filling a cart for a paying customer should pass, a scraper should not. In the log file both look alike. Identity verification solves this by having the agent sign its requests with an operator key and carry a delegation credential describing user consent and the permitted scope — read only, or purchase up to a spending limit. Websites can then apply differentiated rules instead of blanket blocking, and analytics can finally separate agentic traffic from human traffic cleanly.
Marketing Relevance
Without identity verification, merchants must choose between two bad options: block agents outright and lose revenue, or let everything through and risk abuse. A clean split of agent and human traffic is also the precondition for conversion rates and attribution models to remain meaningful at all.
Example
An online shop lets signed agents of an assistant provider with a valid purchase mandate up to EUR 500 into checkout without captcha, while unsigned automation drops to a rate-limited tier. Abandoned agent checkouts fall from 71 to 9 percent without any rise in fraud rate.
Common Pitfalls
A signature only proves who operates the agent — not that its mandate was granted legitimately. Skipping delegation checks and spending limits merely shifts the risk. Equally risky: whitelists that know only the three largest providers and effectively lock smaller agents out.
Origin & History
In 2024 and 2025 operators relied on published IP ranges and reverse DNS checks for major crawlers. As purchasing agents spread this became insufficient, because buying decisions and payment authorisations require robust attribution. In 2026 signature-based methods and delegation formats emerged alongside the first agent payment protocols. The debate thus shifted from whether bots are blocked to which agents are admitted under what mandate.
Marketing Use Cases
Differentiated access rules for agents instead of blanket bot blocking in the shop.
Clean separation of agent and human traffic in web analytics.
Opening price and availability APIs to verified purchasing agents.
Auditable logging of agentic orders for support and returns handling.
Frequently Asked Questions
Isn't the user-agent string enough for detection?
No, because it can be set arbitrarily and carries no proof of the principal. Only a cryptographic operator signature together with a delegation credential allows sound decisions on access, limits and liability.
What belongs in a delegation credential?
At minimum the acting user or organisation, the permitted scope, a spending or quantity limit and an expiry time. A unique transaction ID for traceability and a reference to the mandate's revocation path are advisable additions.
How does this affect analytics?
Verified agent traffic should be tracked as its own dimension and excluded from human conversion rates. Otherwise session duration, bounce rate and conversion rate shift considerably and optimisation decisions rest on mixed populations.
Related Services
Go deeper: Agentic AI Hub · Governance & compliance