Skip to content
roji.ai

Requests ROJI makes to your servers

ROJI is not a crawler. It contacts your infrastructure only when you asked it to — a webhook you registered, or a client-metadata URL your agent presented — and it signs every one of those requests so you can prove they came from us.

Key directory

What we send, and why

RequestTriggerUser-Agent
POST to your webhook endpointAn order event on your account (placed, accepted, delivered, refund…) — only to URLs you registered in the consoleRoji-Webhook/1.0
GET of your client-metadata documentAn agent presented an https: URL as its OAuth client_id (Client ID Metadata Documents); ROJI fetches it once to read the client's metadatadefault

That is the whole list. ROJI does not crawl websites, index pages, or train on content. Business websites are read only during onboarding, by the business itself, through the console.

How the requests are signed

Every request above carries an HTTP Message Signature (RFC 9421) per the IETF Web Bot Auth protocol:

Signature-Agent: "https://roji.ai"
Signature-Input: sig1=("@authority" "signature-agent");created=…;expires=…;keyid="…";alg="ed25519";tag="web-bot-auth"
Signature: sig1=:…:

The public key is published at https://roji.ai/.well-known/http-message-signatures-directory — a JWKS (application/http-message-signatures-directory+json) whose response is itself signed, so the directory cannot be swapped in transit. keyid is the RFC 7638 thumbprint of the key that signed the request.

Webhook deliveries additionally carry the Roji-Webhook-Id, Roji-Webhook-Timestamp and Roji-Webhook-Signature (HMAC over the body with your endpoint secret) headers described on the order lifecycle page. The two mechanisms answer different questions: the HMAC proves the body is intact and meant for your endpoint; Web Bot Auth proves the sender is ROJI, to anyone — including a CDN in front of you that has never seen your secret.

Verify a request

  1. Read Signature-Agent; it must be "https://roji.ai".
  2. Fetch https://roji.ai/.well-known/http-message-signatures-directory (cache it; Cache-Control: max-age=86400).
  3. Pick the key whose thumbprint equals keyid in Signature-Input, and verify Signature over the covered components with Ed25519.

Cloudflare-fronted sites can skip the work: ROJI is registered in Cloudflare's Bots and Agents Directory with this key directory, so its signed requests arrive as a verified bot.

Key rotation

A new key is added to the directory before it signs anything; the old key stays listed for at least 24 hours after its last use. Verifiers that cache the directory for a day never see a key they cannot resolve.

Questions

hi@roji.ai. Abuse or unexpected traffic claiming to be ROJI: the same address — a request whose signature does not verify against the directory above is not from us.