Python library verifies OpenAI's signed AI agent traffic (RFC 9421)

A new Python library, regent-httpsig, implements both sides of the cryptographic handshake OpenAI's agents use with bot-detection infrastructure like Cloudflare, AWS WAF and Google: verifying signed agent requests hitting an API, and signing outgoing agent traffic so it's recognized by bot walls. It covers RFC 9421, the Web Bot Auth draft, and the AAuth protocol.

Notable design choices include SSRF protections by default (HTTPS-only, public-IP checks, no redirect following), bounded key-directory caching to prevent memory exhaustion attacks, and a clear separation between 'proof of key possession' and actual trust, left to the caller's policy layer. Practical details include FastAPI integration, URL reconstruction behind reverse proxies, and a single command to generate keys and the required well-known directory files.

For engineers building or gatekeeping APIs that AI agents call, this addresses a real interoperability gap: reconciling still-evolving drafts (Web Bot Auth, AAuth) with what agents actually ship in production, including OpenAI's legacy signature format, inside one dependency-light verifier.