web bot auth

AutoPasha agent

AutoPasha is an AI employee for small businesses. A company hires it to do ordinary office work in a browser: fill in forms on supplier portals, read public documentation, check order and delivery status, publish the company's own posts and listings. Every action starts from a task given by the customer who hired it.

How it identifies itself

The agent's browser signs its HTTP requests with Web Bot Auth (HTTP Message Signatures, RFC 9421, Ed25519). Each request carries a Signature-Agent: "https://autopasha.ru" header and a signature over @authority and signature-agent with tag="web-bot-auth", a short validity window and a fresh nonce.

Key directory: https://autopasha.ru/.well-known/http-message-signatures-directory. The directory response is signed too (tag="http-message-signatures-directory"), so nobody else can register these keys.

Requests to sites hosted in Russia are not signed: local providers do not support Web Bot Auth.

Behaviour

• Acts only on behalf of the business that hired it, one task at a time, at a human pace.
• Logs in only to accounts that belong to that business.
• Does not crawl, index or collect content for model training, and does not resell what it reads.
• Respects site terms and does not try to get around paywalls or access controls.

Operator and contact

Operated by АвтоПаша (about us). To report a problem with the agent's traffic on your site, write to help@autopasha.ru with the time of the requests and the keyid from them.