From 5833c1f1f7dfdf43135d3f52def4d7d26a4e58a5 Mon Sep 17 00:00:00 2001 From: ulziibay-kernel <253135130+ulziibay-kernel@users.noreply.github.com> Date: Mon, 17 Aug 2026 22:17:15 +0000 Subject: [PATCH 1/3] Drop --url param from web-bot-auth extension examples The --url flag sets the base URL for update.xml and policy templates and defaults to 127.0.0.1. Specifying the customer's domain here breaks extension loading in browser sessions. The intended domain is already covered by --signature-agent, so drop --url from both examples. --- browsers/bot-detection/web-bot-auth.mdx | 2 -- 1 file changed, 2 deletions(-) diff --git a/browsers/bot-detection/web-bot-auth.mdx b/browsers/bot-detection/web-bot-auth.mdx index f54f9fb..7fcaa26 100644 --- a/browsers/bot-detection/web-bot-auth.mdx +++ b/browsers/bot-detection/web-bot-auth.mdx @@ -145,7 +145,6 @@ The directory should contain your public keys in JWKS format: kernel extensions build-web-bot-auth \ --to ./web-bot-auth-ext \ --key ./my-key.jwk \ - --url https://yourdomain.com \ --signature-agent https://yourdomain.com \ --upload my-web-bot-auth ``` @@ -167,7 +166,6 @@ private key (JWK) and upload it under a distinct extension name: kernel extensions build-web-bot-auth \ --to ./web-bot-auth-search-ext \ --key ./kernel-search.jwk \ - --url https://www.kernel.sh \ --signature-agent https://search.bot.kernel.sh \ --upload web-bot-auth-search ``` From caac065ad940875522850044651cebee8ed0639e Mon Sep 17 00:00:00 2001 From: ulziibay-kernel <253135130+ulziibay-kernel@users.noreply.github.com> Date: Mon, 17 Aug 2026 22:20:31 +0000 Subject: [PATCH 2/3] Replace Kernel Search configuration section with link to /docs/bots The Kernel Search configuration steps were wrong to expose. Kernel's own Web Bot Auth identities (Kernel Agent, Kernel Search) are already approved by Cloudflare, Vercel, Akamai, etc. Replace the build/env-var instructions with a short note pointing to /docs/bots and telling readers to contact support if they want to sign with Kernel's identities. --- browsers/bot-detection/web-bot-auth.mdx | 37 ++++--------------------- 1 file changed, 6 insertions(+), 31 deletions(-) diff --git a/browsers/bot-detection/web-bot-auth.mdx b/browsers/bot-detection/web-bot-auth.mdx index 7fcaa26..8b979a3 100644 --- a/browsers/bot-detection/web-bot-auth.mdx +++ b/browsers/bot-detection/web-bot-auth.mdx @@ -149,38 +149,13 @@ kernel extensions build-web-bot-auth \ --upload my-web-bot-auth ``` -### 4. Kernel Search configuration +### 4. Using Kernel's bot identities -Kernel Search uses a distinct Web Bot Auth identity from Kernel's user-driven -agent traffic: - -- User-Agent: `KernelSearchBot` -- Signature-Agent: `https://search.bot.kernel.sh` -- Key directory: - `https://search.bot.kernel.sh/.well-known/http-message-signatures-directory` - -To build a browser extension for Kernel Search, use the Kernel Search Ed25519 -private key (JWK) and upload it under a distinct extension name: - -```bash -kernel extensions build-web-bot-auth \ - --to ./web-bot-auth-search-ext \ - --key ./kernel-search.jwk \ - --signature-agent https://search.bot.kernel.sh \ - --upload web-bot-auth-search -``` - -For host-proxy based signing, configure the Search crawler's host-proxy -environment with: - -```bash -HOST_PROXY_WEB_BOT_AUTH_ENABLED=true -HOST_PROXY_WEB_BOT_AUTH_KEY_PATH=/path/to/kernel-search-private-key.pem -HOST_PROXY_WEB_BOT_AUTH_DIRECTORY_URL=https://search.bot.kernel.sh -``` - -The signing key must correspond to the public key hosted by -`search.bot.kernel.sh`. +Kernel's own Web Bot Auth identities are already approved by Cloudflare, Vercel, +Akamai, and other bot-verification providers. If you want to sign requests with +one of Kernel's identities rather than your own, [contact Kernel support](https://www.kernel.sh/docs/info/support). +See [Bots and agents](/docs/bots) for the list of identities and their key +directories. ### 5. Register with Vercel and other Web Bot Auth-aware directories (optional) From ed5fb28386ab8d733d9875f2671be00319351135 Mon Sep 17 00:00:00 2001 From: ulziibay-kernel <253135130+ulziibay-kernel@users.noreply.github.com> Date: Mon, 17 Aug 2026 22:24:36 +0000 Subject: [PATCH 3/3] Fix /docs/bots -> /bots link in web-bot-auth Mintlify uses the /bots path, not /docs/bots. --- browsers/bot-detection/web-bot-auth.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/browsers/bot-detection/web-bot-auth.mdx b/browsers/bot-detection/web-bot-auth.mdx index 8b979a3..301ece3 100644 --- a/browsers/bot-detection/web-bot-auth.mdx +++ b/browsers/bot-detection/web-bot-auth.mdx @@ -154,7 +154,7 @@ kernel extensions build-web-bot-auth \ Kernel's own Web Bot Auth identities are already approved by Cloudflare, Vercel, Akamai, and other bot-verification providers. If you want to sign requests with one of Kernel's identities rather than your own, [contact Kernel support](https://www.kernel.sh/docs/info/support). -See [Bots and agents](/docs/bots) for the list of identities and their key +See [Bots and agents](/bots) for the list of identities and their key directories. ### 5. Register with Vercel and other Web Bot Auth-aware directories (optional)