Cloudflare and AWS WAF now verify signed agent identities at the edge, and Amazon and Shopify took opposite paths with Meta's Muse in 24 hours

An agent that arrives at your storefront as a signed-in browser has, for most of the web's history, been indistinguishable from a person with unusually fast reflexes. That is the gap two pieces of edge infrastructure now close. The New Stack reports that Cloudflare validates Web Bot Auth signatures at its edge for verified bots and agents, and that AWS WAF Bot Control added the same support for CloudFront distributions in November 2025. Both read an IETF draft called Web Bot Auth, which sits on top of HTTP Message Signatures (RFC 9421).

The mechanism is small on purpose. An agent signs its request with a private key and publishes the matching public key at a well-known directory on its own domain. The verifier reads the Signature-Agent header, fetches the key set, and learns which operator is calling. A merchant on Cloudflare gets that verdict as a policy input at its edge, before the request reaches an application server.

The signature names the operator, and authorisation still needs its own answer

The signature tells a merchant the operator behind the agent. Whose account the agent is acting for, and what the shopper authorised, are separate facts that the signature does not carry. The New Stack's Sergio De Simone points out that this gap is the whole reason Amazon rejected Meta's Muse: the dispute is about who holds a stored password. Signed identity settles the disclosure question and leaves authorisation open.

The authorisation half is being answered by a second stack of specifications, and this is where the practical difference between block and admit lives. The Agentic Commerce Protocol from OpenAI and Stripe covers checkout execution while the merchant stays the system of record. Google and Shopify's Universal Commerce Protocol covers discovery, cart and checkout. Google's Agent Payments Protocol, donated to the FIDO Alliance in April 2026, includes proof of the shopper's authorisation. A merchant that adopts one gets identity, scope and an audit trail in the same transaction.

Amazon and Shopify picked opposite sides of the same choice in one day

The New Stack reports that Amazon started blocking Meta's Muse from browsing and buying on Amazon.com on Sunday, roughly two weeks after Muse launched on September 8, citing agents that do not identify themselves in user-agent strings and appear to capture stored credentials. Amazon reached for its Conditions of Use rather than the Computer Fraud and Abuse Act, after the Ninth Circuit vacated the preliminary injunction Amazon had won against Perplexity and held that a user directing an assistant is the party accessing Amazon's computers.

On September 21, Meta and Shopify announced agentic checkout with Shop Pay across Shopify stores. Muse reads structured product data and completes payment through a declared path, and each purchase draws a single-use credential, so the card number never reaches Muse. Both routes follow from the business underneath them, and the two moves inside 24 hours put the decision squarely back in the product and infrastructure teams' hands.

The three questions a platform team can answer this quarter: what an unidentified agent may do on your surfaces at all, where you route an identified one so it does not have to drive a browser, and whether an account access ever accepts a replayed password rather than a scoped token.

Source

The New Stack, Amazon blocked Meta's Muse. Then Shopify wired it into every store. by Sergio De Simone, 23 September 2026. Cloudflare's bot verification documentation on Web Bot Auth. Meta and Shopify's agentic checkout announcement, 21 September 2026.