---
title: "Requests ROJI Makes to Your Servers — Web Bot Auth | roji.ai"
description: "ROJI sends two kinds of automated requests to third-party servers — webhook deliveries to endpoints you registered and fetches of OAuth client-metadata documents — both signed with Web Bot Auth so you can verify they came from ROJI."
doc_version: 78e6c05681f1
last_updated: 2026-08-30
---
# Requests ROJI Makes to Your Servers — Web Bot Auth | roji.ai

Developers

Requests from ROJI

Requests ROJI makes to your servers

ROJI is not a crawler. It contacts your infrastructure only when you asked it to — a webhook you registered, or a client-metadata URL your agent presented — and it signs every one of those requests so you can prove they came from us.

Key directory

## What we send, and why

| Request | Trigger | User-Agent |
| --- | --- | --- |
| `POST` to your **webhook endpoint** | An order event on your account (placed, accepted, delivered, refund…) — only to URLs you registered in the console | `Roji-Webhook/1.0` |
| `GET` of your **client-metadata document** | An agent presented an `https:` URL as its OAuth `client_id` (Client ID Metadata Documents); ROJI fetches it once to read the client's metadata | default |

That is the whole list. ROJI does not crawl websites, index pages, or train on content. Business websites are read only during onboarding, by the business itself, through the console.

## How the requests are signed

Every request above carries an [HTTP Message Signature (RFC 9421)](https://www.rfc-editor.org/rfc/rfc9421) per the IETF [Web Bot Auth](https://datatracker.ietf.org/wg/webbotauth/about/) protocol:

```http
Signature-Agent: "https://roji.ai"
Signature-Input: sig1=("@authority" "signature-agent");created=…;expires=…;keyid="…";alg="ed25519";tag="web-bot-auth"
Signature: sig1=:…:
```

The public key is published at **`https://roji.ai/.well-known/http-message-signatures-directory`** — a JWKS (`application/http-message-signatures-directory+json`) whose response is itself signed, so the directory cannot be swapped in transit. `keyid` is the RFC 7638 thumbprint of the key that signed the request.

Webhook deliveries additionally carry the `Roji-Webhook-Id`, `Roji-Webhook-Timestamp` and `Roji-Webhook-Signature` (HMAC over the body with your endpoint secret) headers described on the [order lifecycle page](/developers/ordering). The two mechanisms answer different questions: the HMAC proves the body is intact and meant for your endpoint; Web Bot Auth proves the sender is ROJI, to anyone — including a CDN in front of you that has never seen your secret.

## Verify a request

1. Read `Signature-Agent`; it must be `"https://roji.ai"`.
2. Fetch `https://roji.ai/.well-known/http-message-signatures-directory` (cache it; `Cache-Control: max-age=86400`).
3. Pick the key whose thumbprint equals `keyid` in `Signature-Input`, and verify `Signature` over the covered components with Ed25519.

Cloudflare-fronted sites can skip the work: ROJI is registered in Cloudflare's Bots and Agents Directory with this key directory, so its signed requests arrive as a verified bot.

## Key rotation

A new key is added to the directory before it signs anything; the old key stays listed for at least 24 hours after its last use. Verifiers that cache the directory for a day never see a key they cannot resolve.

## Questions

[hi@roji.ai](mailto:hi@roji.ai). Abuse or unexpected traffic claiming to be ROJI: the same address — a request whose signature does not verify against the directory above is not from us.

## Sitemap

- [Every public page, as markdown](/sitemap.md)
- [llms.txt](/llms.txt) · [AGENTS.md](/AGENTS.md) · [auth.md](/auth.md)