OpenAI

ChatGPT Work's Cloud browser allowlisting

Allow ChatGPT Work's Cloud browser to reach your site securely and reliably.

Updated: 18 hours ago

Overview

ChatGPT Work's Cloud browser uses Web Bot Auth to sign outbound HTTP requests, allowing website operators to verify that requests genuinely originate from ChatGPT.

Allowlisting Cloud browser traffic in your CDN or firewall helps prevent legitimate requests from being blocked while preserving your existing security controls.

How message signatures work

Cloud browser uses the HTTP Message Signatures standard, RFC 9421, to authenticate requests.

Each request includes:

  • A Signature header.

  • A Signature-Input header.

  • A Signature-Agent header set to "https://chatgpt.com".

Public keys for verifying these signatures are available at:

https://chatgpt.com/.well-known/http-message-signatures-directory

Your CDN, firewall, or edge service can retrieve the public key, validate the signature, and confirm that a request originated from ChatGPT.

Allowlisting with Akamai

Akamai identifies Cloud browser traffic under the existing bot name ChatGPT Agent in its AI Fetchers and Agents bots category.

To allow this traffic:

  • In your Akamai Security Configuration, open Shared Resources.

  • Select Custom Bot Categories in the navigation bar.

  • Click the + icon to create a new custom bot category.

  • Add a new bot category and save it.

  • Within that new bot category, create a bot with:

    • Type: Verified Bots

    • Bot name: ChatGPT Agent

  • Close Shared Resources and open the relevant Security Policy.

  • Select Bot & Agent Control, and within that screen select Custom Bots and set the new category’s action to Allow.

Akamai verifies request signatures automatically. No custom signature verification is required.

Allowlisting with Cloudflare

Option 1: Via AI Crawler and Agent access policies

Cloudflare verifies Cloud browser traffic and shows it as dots, OpenAI under Personal Agents.

To allow this traffic:

  1. In the Cloudflare dashboard, select your domain, then go to Security > Settings.

  2. Filter by Bot traffic, then select AI Crawler and Agent access policies.

  3. Under Personal Agents, set dots, OpenAI to Allow (do not block).

  4. Select Save.

Option 2: Via WAF custom rules

Cloudflare recognizes Cloud browser traffic as a signed agent in its Bots and Agents directory.

The existing identifiers are:

  • Bot tag: chatgpt-agent

  • Detection ID: 129220581

To allow this traffic:

  • In the Cloudflare dashboard, open Security → WAF and create a custom rule.

  • Set the rule expression to Bot Detection ID equals.

  • Search for ChatGPT Operator and select detection ID 129220581.

  • Configure the rule to allow or skip requests matching this detection ID.

  • Save and deploy the rule.

Cloudflare verifies request signatures automatically. No additional signature verification is required.

Allowlisting with HUMAN

HUMAN Sightline

HUMAN recognizes Cloud browser traffic under the existing bot name ChatGPT Agent in Known Bots & Crawlers.

To allow it:

  • In your Sightline or BD console, go to Policies → Traffic Policy Settings → Known bots & Crawlers.

  • Search for ChatGPT Agent.

  • Set the rule to ON and select Allow.

HUMAN AgenticTrust

HUMAN AgenticTrust verifies Cloud browser traffic and allows you to manage permissions associated with the existing ChatGPT Agent entry.

To update those permissions:

  • In your Sightline console, open Policies → AI Agents Permissions.

  • Search for ChatGPT Agent.

  • Review and update the available permissions as needed.

HUMAN verifies request signatures automatically. Its permission settings do not change Cloud browser’s supported capabilities: at launch, Cloud browser cannot sign in to websites or complete payments.

Allowlisting with Vercel

If your site is hosted on Vercel, no additional configuration is required to allow Cloud browser traffic.

Vercel recognizes this traffic through the existing ChatGPT Agent entry, identified as chatgpt-operator, and automatically verifies its signed requests.

For more information, see Vercel’s support for Web Bot Auth.

Allowlisting with other CDNs

If your CDN or firewall does not automatically recognize Cloud browser traffic, you can verify requests directly:

Troubleshooting

If legitimate Cloud browser traffic is blocked, confirm that intermediate proxies preserve the following headers:

  • Signature

  • Signature-Input

  • Signature-Agent

Also confirm that your allowlisting rule uses the provider-specific bot name or detection ID listed above.

Was this article helpful?