Identify AI agents

You can now see which supported AI agents and browser automation tools are interacting with your application. Castle returns their identity in a new top-level agent object, including the agent's name, operator, category, and how it was identified.

Castle uses verified Web Bot Auth signatures, browser fingerprints, and recognized user-agent strings. Identification is separate from risk scoring and does not change your bot or abuse scores or existing enforcement decisions. A verified signature confirms the signer, not that a request is safe.

For signature verification, forward the incoming Signature-Input, Signature, Signature-Agent, and original Host headers in context.headers. See AI agent identification for response fields and integration details.

Example API response:

{
  "agent": {
    "name": "ChatGPT agent",
    "operator": "openai",
    "category": "ai_agent",
    "identified_by": ["web_bot_auth"]
  }
}