Does a valid signature authorize an action?

No. It identifies the Hyperbrowser session. Your site must still check the user's session and permissions.

Hyperbrowser: AI Crawler Guide & robots.txt

What is Hyperbrowser?

Hyperbrowser is infrastructure: developers run browser sessions on it, and each session can sign its requests. Its Web Bot Auth documentation says signing follows Web Bot Auth, built on HTTP Message Signatures (RFC 9421), and is enabled for teams on request.

Cloudflare lists no user-agent pattern, and publishes the key directory https://www.hyperbrowser.ai/.well-known/http-message-signatures-directory. A valid signature identifies the Hyperbrowser session, not the person or company behind the task, and not every Hyperbrowser session is signed.

Relevant for AI search

Is Hyperbrowser relevant for AI search?

Yes. Hyperbrowser runs cloud browsers that AI agents use to complete tasks, so it decides whether those agents can use your site.

Hyperbrowser provides cloud browsers for AI agents. They navigate websites and complete tasks for their users. Blocking signed Hyperbrowser sessions stops those agents from reading or acting on your site, while it does not remove you from any index.

How to handle Hyperbrowser

Treat signed Hyperbrowser traffic as an automated browser acting for someone. Keep public pages open under your normal browser policy and keep authorization checks on forms, accounts and purchases. To allow or block it, verify the signature at your CDN or WAF. No robots.txt token is recorded.

Examples

An agent fills in a quote request form through a Hyperbrowser session, and the request arrives with a Web Bot Auth signature.
A retailer blocks signed Hyperbrowser traffic on checkout paths while leaving product pages open.