Web Auth Auth - Valid Signatures Not Accepted

Online Store and Theme Development
1

Short description of issue

Web Bot Auth: our third-party signature is not accepted, but a merchant-minted one on the same store is. Cloudflare recognize the validity of the signature

Reproduction steps

  1. Mint a Web Bot Auth signature for authority our-store.myshopify.com:
    Ed25519, covered components (“@authority” “signature-agent”), tag=“web-bot-auth”,
    public key published at
    https://our-agent-domain/.well-known/http-message-signatures-directory

  2. GET https://our-store.myshopify.com/ with the resulting
    Signature, Signature-Input, and Signature-Agent: “https://our-agent-domain”

  3. Repeat the same GET twice more, seconds apart, interleaved:
    (a) with no signature headers at all
    (b) with a merchant-minted signature from that store’s admin
    (Signature-Agent: “https://shopify.com”)

  4. Compare the shopify-complexity-score response header across the three.

Expected: our signed request is treated as verified signed traffic, as the
merchant-minted one is (score 0).

Actual: our signature scores in the same range as unsigned traffic (27-51).
Only the merchant-minted signature scores 0. All three return HTTP 200.

Additional info

We run automated QA against Shopify storefronts and are adopting Web Bot Auth.
The store referenced is ours.

Our signature verifies against Cloudflare Research’s reference verifier
(“Signature is valid.”) and our key directory passes its directory validator.
Same result with both our production and staging identities, on two stores we own.

Controls suggest the issue is specific to our key: a merchant-minted signature
with one bit flipped, and a valid one presented to a different store, are both
rejected. So verification is working. Not expiry either - 880+ seconds of
validity remained.

Log lookup: 2026-08-17T21:22:36Z to 21:22:55Z, single IP, entering at DEN.
cf-ray values, our setup, and specific questions are in the reply below. Happy
to share the store domain, directory URL, and User-Agent privately.

What type of topic is this

Troubleshooting

2

Details from above that didn’t fit the submission form character limits:

Third-party Web Bot Auth signature not accepted

We are adopting Web Bot Auth so our tooling identifies itself properly. Our signature verifies everywhere we can check it — Cloudflare Research’s reference verifier returns “Signature is valid.”, and its directory validator says our key directory looks valid — but Shopify appears not to accept it, and we can’t work out why on our end.

Our attempts

Store r****-*****-****.myshopify.com (ours, live production, no password protection), 2026-08-17 ~21:22 GMT, single IP. Every request returned HTTP 200.

Source shopify-complexity-score ×5 first cf-ray
our signature (production identity) 51, 37, 43, 48, 27 a2cbbc3fb93de771-DEN
our signature (staging identity) 104, 43, 34, 27, 37 a2cbbc460e57e771-DEN
merchant-minted, from this store’s admin 0, 0, 0, 0, 0 a2cbbc4c9d7ce771-DEN

Our setup
Signature-Agent "https://b***.r****.com"
Directory https://b***.r****.com/.well-known/http-message-signatures-directory
keyid 2QEMLjvAPjpNTMCX1KBPg1HywzOu10AsD3pBuTyFLc4
Key Ed25519, published as a signed JWK set, application/http-message-signatures-directory+json
Covered components ("@authority" "signature-agent")
Signature params tag="web-bot-auth", alg="ed25519", created, expires, nonce, (15-minute expiry)

Questions

  1. Do those requests show as verified signed traffic on your side, and if not, what specifically fails? The cf-ray values above might let you pull the two adjacent requests — ours and the accepted merchant one — and diff them? In this thread the answer for a similar third-party crawler was that the signature couldn’t be verified, but that thread seems to have residential IP success, whereas we have not yet had a successful acceptance.

  2. Is signing sufficient on its own, or is there a qualification step for a third-party agent? The Shopify higher limit request form might help us “qualify for higher rate limits”, but we don’t know if Shopify needs to recognize our Signature Agents “https://b***.r****.com” and “https://b***.s****-r****.com”. In the future we may explore higher rate limits if needed, but we are attempting to only qualify for the standard, signed request rate limiting at this time.

  3. Does shopify-complexity-score: 0 indicates an accepted signature?

  4. Are there requirements on the key directory or signature parameters beyond the draft? Comparing ours with the one at shopify.com, on Cloudflare’s debugger, we differ in ways the draft permits but which we’d happily change if any of them matter:

    ours shopify.com
    directory shape {"keys":[…]} (JWK set) a bare JWK object
    directory response signed yes no
    JWK members kty, crv, x, kid plus use, alg, nbf, exp
    alg in Signature-Input alg="ed25519" present absent
    signature TTL 15 minutes ~30 days

Please let us know if you have any additional information on your end that can help us debug our Web Bot Auth setup, or need any additional data from us. We have followed Shopify’s setup documentation to the best of our ability, including Cloudflare’s recommended setup addendums.