OsanoBot

OsanoBot is Osano's web retrieval agent for Compliance Check. It loads web pages to assess cookie, consent, and privacy-signal behavior.

Identify requests

Requests to the monitored hostname and its leading www alias carry the OsanoBot User-Agent and these Web Bot Auth headers:

Signature-Agent: "https://bots.osano.com"
Signature: ...
Signature-Input: ...

Verify requests

Osano signs requests with Ed25519 and publishes the public keys in its HTTP Message Signatures directory. The Signature-Input header supplies the key identifier and validity window.

Use a verifier that supports Web Bot Auth and RFC 9421 to validate the signature against the current directory. The validated signature establishes Osano's identity.

Cloudflare verifies Osano's signed requests at its edge. The Cloudflare guide explains how to allow verified bots and confirm recognition.

Control access

Use your firewall's verified-bot settings to allow or block traffic. These settings can apply to all verified bots. For a header-based exception, use Custom Headers.

Signed scans follow the OsanoBot rules in robots.txt. Use the robots.txt examples to select the paths you want scanned.

Contact support

For questions about OsanoBot traffic, contact Osano Support with the hostname, request time and timezone, and firewall event or request identifier.