GydrBot#
GydrBot is how Gydr identifies the requests it sends to your servers. It is operated by Gydr and only calls endpoints you have configured in your Gydr account. Each request is signed with Web Bot Auth (Ed25519 HTTP Message Signatures, RFC 9421), the standard Cloudflare uses to verify bots, so a site behind bot protection can tell GydrBot from an unknown cloud address.
What GydrBot sends#
- Request
- Webhook deliveries
- Sent to
- The webhook endpoints you register
- Documented in
- Webhooks
- Request
- Conversation API callbacks
- Sent to
- The callback URL on your API key
- Documented in
- Sessions & Messages
- Request
- Custom Desk calls
- Sent to
- The base URL of your agent inbox
- Documented in
- Custom Desk
| Request | Sent to | Documented in |
|---|---|---|
| Webhook deliveries | The webhook endpoints you register | Webhooks |
| Conversation API callbacks | The callback URL on your API key | Sessions & Messages |
| Custom Desk calls | The base URL of your agent inbox | Custom Desk |
GydrBot does not crawl, index or scrape websites, and it does not collect data for AI training.
How to recognise it#
- Header
User-Agent- Value
GydrBot/1.0 (+https://docs.gydr.ai/api/gydrbot)
- Header
Signature-Agent- Value
- The origin of Gydr's key directory, as a quoted string:
"https://public.api.gydr.ai"
- Header
Signature-Input- Value
- Covers
@authorityandsignature-agent, withtag="web-bot-auth",alg="ed25519", akeyid, and a 60-secondcreated/expireswindow.
- Header
Signature- Value
- The Ed25519 signature over those components.
| Header | Value |
|---|---|
User-Agent | GydrBot/1.0 (+https://docs.gydr.ai/api/gydrbot) |
Signature-Agent | The origin of Gydr's key directory, as a quoted string: "https://public.api.gydr.ai" |
Signature-Input | Covers @authority and signature-agent, with tag="web-bot-auth", alg="ed25519", a keyid, and a 60-second created/expires window. |
Signature | The Ed25519 signature over those components. |
This identifies Gydr; it doesn't replace your check
X-Gydr-Signature, the HMAC made with your own secret. If Gydr ever can't sign a request, it is still delivered, without the Web Bot Auth headers.Key directory#
Gydr publishes its public key at the standard Web Bot Auth location. The response is itself signed with the key it lists:
curl -sS -D - https://public.api.gydr.ai/.well-known/http-message-signatures-directoryLetting GydrBot through#
Bot protection that judges callers by their address can block Gydr's requests, usually with a 403. Gydr does not publish a fixed list of IP addresses, so don't rely on an IP allowlist. The Custom Desk guide lists what to change for each Cloudflare protection setting; the same steps apply to webhook and callback endpoints: Let Gydr's requests reach your code.
Contact#
To report a problem with GydrBot traffic, contact Gydr.