The typical 2026 AI agent farm relies on clusters of nodes running Camoufox, Playwright, or AdsPower, each consuming 500 MB to 1.5 GB of memory, plus residential IP pools billed by the gigabyte and separate modules that simulate human-like mouse movements with Bézier curves.
This architecture forces organizations into a zero-sum arms race: defenders build increasingly sophisticated fingerprint detection while attackers invest ever more resources in evasion. The result is wasted hardware, rising costs, and fragile systems that break after every WAF heuristic update.
RFC 9421 (HTTP Message Signatures, published February 2024 by the IETF) replaces mimicry with cryptographic proof. An agent signs the request with an Ed25519 private key; the server verifies the signature against a public key retrieved from a trusted directory indicated by the new Signature-Agent header.
The open-source wbauth project implements this standard with three components: the wb-auth@0.4.0 npm package for Node/Bun/Deno/Workers, the wbauth-sdk@0.4.0 PyPI package with httpx and requests adapters, and a Cloudflare Workers + D1 directory for key registration, rotation, and revocation.
Performance comparisons demonstrate dramatic gains: cold start falls from 1744 ms to 5 ms, per-request latency drops from 86.8 ms to 15.8 ms, memory usage shrinks from 500 MB to 0.76 MB, and runtime disk footprint decreases from 1.3 GB to 14 MB. The solution also removes dependency on proxies and eliminates breakage during WAF updates.
Server-side verification at the edge or WAF follows five steps: retrieve the public key from the directory with KV/Redis caching, build the canonical signature string according to RFC 9421 rules, perform the Ed25519 verification, validate created and expires timestamps to block replay attacks, and forward the request to the origin API without triggering CAPTCHA or blocking mechanisms.
Developers can integrate the protocol immediately using the provided code examples for Python and TypeScript. The project invites community discussion on shifting from fingerprint evasion to standardized cryptographic bot authentication.
