# The renderer as a bot

Who runs the screenshot renderer, why it visits a site, how it signs its requests (Web Bot Auth), where its key directory is, and how a site owner can block it.

When someone asks CurlShot for a screenshot of your site, a browser on our servers opens the page. This page says who that is, so that you can recognise the visit and decide what to do about it.

Every request the renderer sends carries these three headers:

```http
Signature-Agent: "https://curlshot.com"
Signature-Input: sig1=("@authority" "signature-agent");created=1735689600;keyid="<key thumbprint>";alg="ed25519";expires=1735689660;nonce="...";tag="web-bot-auth"
Signature: sig1=:...:
```

## Who it is

- **Operator:** the company named in the [terms](https://curlshot.com/terms). It runs the CurlShot screenshot API (https://curlshot.com).
- **What it is:** a headless Chromium browser, started per request. It is not a crawler: it never follows links on its own and never builds an index. It loads the one address an API user sent, plus what that page needs to draw itself (scripts, styles, images, fonts), takes a picture or a PDF, and closes.
- **Who starts a visit:** always a person or program using the CurlShot API with their own account. CurlShot does not pick pages to visit. A visit is the same as that person opening your page in a browser.
- **Rate:** one page load per screenshot. Every account has rate and concurrency limits, so one account cannot hit a site hard.
- **Contact:** support@curlshot.com or the [contact page](https://curlshot.com/contact). Tell us the address of your site and what you saw.

## How to recognise it

The renderer sends the User-Agent of a current desktop Chrome on Linux (`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/<version> Safari/537.36`). It matches every Chrome, so do not rely on it. The reliable mark is the signature below.

The headers follow [Web Bot Auth](https://developers.cloudflare.com/bots/reference/bot-verification/web-bot-auth/) (HTTP Message Signatures, RFC 9421, with the IETF drafts `draft-meunier-web-bot-auth-architecture` and `draft-meunier-http-message-signatures-directory`):

- The signature covers the host the request goes to (`@authority`) and the `Signature-Agent` header, and is valid for 60 seconds.
- `Signature-Agent` names the origin that publishes the public key: https://curlshot.com.
- The public key is in a signed key directory at **https://curlshot.com/.well-known/http-message-signatures-directory** (a JSON Web Key Set, Ed25519, served as `application/http-message-signatures-directory+json`). A request is ours if its signature verifies with a key in that directory.

Anyone can imitate the User-Agent or the headers; nobody can forge the signature without the private key. Cloudflare and other services that support Web Bot Auth can verify these signatures (see [verified bots](https://developers.cloudflare.com/bots/concepts/bot/verified-bots/)).

## What it does and does not do

- It identifies itself on every request, whatever the host and resource type.
- It does not solve CAPTCHAs, click through "verify you are human" pages or work around a challenge. A page that answers with a bot check is not captured: the API user gets the `page_blocked` error and is not charged.
- It does not read `robots.txt`: like a link preview or a person's browser, it fetches one address a user asked for. If you do not want it on your site, block it as below.
- It only visits public addresses. Private networks, localhost and cloud metadata addresses are refused before any connection.

## How to block or allow it

- **Block by signature.** Match the `Signature-Agent` request header (its value is `"https://curlshot.com"`). In a firewall or WAF rule, block requests where that header is present, or verify the signature against the key directory above and block on the `keyid`.
- **Allow it on your own site.** If you are the owner and your bot protection blocks your own screenshots, allow the same signature, or add a rule that matches a secret header you send in the [`headers`](https://curlshot.com/docs/options.md) option.
- **Ask us.** Write to support@curlshot.com with your domain and we will look at it. See also the [acceptable use policy](https://curlshot.com/acceptable-use).