Agent Ready Crawlers

The field guide to every AI crawler and agent at the door, and the vendors who decide who gets in.

Agent verification provider

Visa

In short

Visa's Trusted Agent Protocol has agents sign requests under the agent-browser-auth or agent-payer-auth tag, with Visa hosting the public keys, so a merchant or its site protection provider can verify them before letting an agent browse or pay. Akamai announced support on 18 December 2025, and no public list of registered agents is linked.

Type
Verification provider
Homepage
developer.visa.com
In one line
Card network whose Trusted Agent Protocol lets a merchant or its CDN verify, from RFC 9421 signatures tagged agent-browser-auth or agent-payer-auth, that a visiting agent is approved under Visa Intelligent Commerce and acting for a known consumer.
Last read
2026-11-05

What Visa does for this layer

From the vendor's own pages

Visa says it and more than 10 partners introduced Trusted Agent Protocol in October 2025 as an open framework on existing web infrastructure to help merchants tell legitimate AI agents from malicious bots. (usa.visa.com, dated 2025-12-18) Visa's merchant specification builds the agent recognition signature on HTTP Message Signatures "defined by RCF 9421 [and aligned with web-bot-auth]", with the Signature-Input tag set to agent-browser-auth for browsing or agent-payer-auth for payment. (developer.visa.com) Visa's specification tells merchants to block a signed request when its created and expires timestamps are more than 8 minutes apart, and to block a nonce already seen in the last 8 minutes. (developer.visa.com) Trusted Agent Protocol carries three linked signatures: the agent recognition signature in the header, a signed consumer recognition object with a Visa ID Token in the body, and a signed payment container for checkout. (developer.visa.com)

For Visa's implementation, Visa hosts the public keys at a well-known URL with a GET /keys operation that returns a JSON Web Key for a given keyID, so merchants do not fetch keys from each agent's own domain. (developer.visa.com) Visa's specification says a signature that verifies against a Visa-associated key implies the agent's participation in and compliance with Visa Intelligent Commerce program requirements. (developer.visa.com) Visa's specification names Site Protection Providers, meaning CDNs, trust management systems and proxies, as an intended audience next to merchants, and lets merchants that have not adopted the protocol ignore the signatures. (developer.visa.com) Visa's specification foresees merchants using the protocol to request payment from an agent for access to certain information, giving customer product reviews as the example. (developer.visa.com)

Visa's GitHub sample for Trusted Agent Protocol ships five components: an agent registry for public keys, a React merchant frontend, a FastAPI merchant backend, a Node.js CDN proxy that verifies RFC 9421 signatures, and a Streamlit TAP agent. (github.com) Reading Visa's Trusted Agent Protocol specification requires agreeing to the Visa Trusted Agent Protocol Product Terms, which the specification page states before its introduction. (developer.visa.com) Visa announced on 18 Dec 2025 that Akamai was the latest company to support Trusted Agent Protocol, integrating it with Akamai's edge behavioural intelligence and bot and abuse protection. (usa.visa.com, dated 2025-12-18) Visa, BILL and Billtrust announced on 20 Oct 2026 a live pilot in which a BILL Payment Agent registered through Trusted Agent Protocol and Visa's Agentic Directory pays supplier invoices on Billtrust portals, with agent authentication standing in for CAPTCHA and bot blocking. (usa.visa.com, dated 2026-10-20)

Claims the vendor makes about itself

Visa reported on 18 Dec 2025 more than 100 partners, over 30 building in the Visa Intelligent Commerce sandbox and over 20 agents and agent enablers integrating directly, with hundreds of agent-initiated transactions completed. (usa.visa.com, dated 2025-12-18)

Products and plans

ProductWhat it doesPrice modelFromAs of
Trusted Agent Protocol Merchant specification and sample code for verifying signed agent requests, consumer recognition and payment containers. No price recorded
Visa Intelligent Commerce Visa's agentic commerce programme; agents onboard to it and their keys are hosted by Visa. No price recorded
Agentic Directory Registration Visa names for trusted agents, used by the BILL Payment Agent in the October 2026 pilot. No price recorded

Standards

StandardStatusEvidence
Web Bot Auth Supports The agent recognition signature is RFC 9421 "aligned with web-bot-auth"; keys come from a Visa-hosted key store rather than each agent's directory. (developer.visa.com)
Published IP list No statement The specification lists IP allowlisting as one possible way to identify agents and chooses signed credentials instead; Visa publishes no agent IP ranges (checked 2026-11-05).
Visa Trusted Agent Protocol Supports Visa publishes and maintains the Trusted Agent Protocol specification and sample implementation. (developer.visa.com)
Mastercard Agent Pay No statement The specification refers to a shared approach across Payment Schemes without naming Mastercard Agent Pay (checked 2026-11-05).

Our checks

CheckResultMethodDate
Homepage fetch HTTP 200 GET with the crawl user agent after a robots.txt check 2026-11-05

What Visa does not do

  • Visa does not block or admit anything itself; the merchant or its site protection provider verifies the signature and decides.
  • Visa's Trusted Agent Protocol pages read on 2026-11-05 link no public list of the agents registered in the Agentic Directory.
  • Trusted Agent Protocol says nothing about crawlers that do not carry commerce intent; training and search bots stay with robots.txt and bot management.

Reading notes

Visa's investor-site release on the October 2025 launch is a JavaScript page that a plain fetch cannot read, so the launch is cited from Visa's release of 18 December 2025. The specification spells RFC 9421 as RCF 9421, and quotes here keep Visa's spelling.

Sources

Last reviewed 2026-11-05