GydrBot

How Gydr identifies the webhooks, callbacks and Custom Desk calls it sends to your servers.

Stop 5 of 5

On this page5 sections

What GydrBot sends
How to recognise it
Key directory
Letting GydrBot through
Contact

GydrBot

GydrBot is how Gydr identifies the requests it sends to your servers. It is operated by Gydr and only calls endpoints you have configured in your Gydr account. Each request is signed with Web Bot Auth (Ed25519 HTTP Message Signatures, RFC 9421), the standard Cloudflare uses to verify bots, so a site behind bot protection can tell GydrBot from an unknown cloud address.

What GydrBot sends

Request: Webhook deliveries
Sent to: The webhook endpoints you register
Documented in: Webhooks

Request: Conversation API callbacks
Sent to: The callback URL on your API key
Documented in: Sessions & Messages

Request: Custom Desk calls
Sent to: The base URL of your agent inbox
Documented in: Custom Desk

Request	Sent to	Documented in
Webhook deliveries	The webhook endpoints you register	Webhooks
Conversation API callbacks	The callback URL on your API key	Sessions & Messages
Custom Desk calls	The base URL of your agent inbox	Custom Desk

GydrBot does not crawl, index or scrape websites, and it does not collect data for AI training.

How to recognise it

Header: User-Agent
Value: GydrBot/1.0 (+https://docs.gydr.ai/api/gydrbot)

Header: Signature-Agent
Value: The origin of Gydr's key directory, as a quoted string: "https://public.api.gydr.ai"

Header: Signature-Input
Value: Covers @authority and signature-agent, with tag="web-bot-auth", alg="ed25519", a keyid, and a 60-second created/expires window.

Header: Signature
Value: The Ed25519 signature over those components.

Header	Value
`User-Agent`	`GydrBot/1.0 (+https://docs.gydr.ai/api/gydrbot)`
`Signature-Agent`	The origin of Gydr's key directory, as a quoted string: `"https://public.api.gydr.ai"`
`Signature-Input`	Covers `@authority` and `signature-agent`, with `tag="web-bot-auth"`, `alg="ed25519"`, a `keyid`, and a 60-second `created`/`expires` window.
`Signature`	The Ed25519 signature over those components.

This identifies Gydr; it doesn't replace your check

You don't need to verify these headers. Your integration still authenticates each request with X-Gydr-Signature, the HMAC made with your own secret. If Gydr ever can't sign a request, it is still delivered, without the Web Bot Auth headers.

Key directory

Gydr publishes its public key at the standard Web Bot Auth location. The response is itself signed with the key it lists:

Fetch the key directory
curl -sS -D - https://public.api.gydr.ai/.well-known/http-message-signatures-directory

Letting GydrBot through

Bot protection that judges callers by their address can block Gydr's requests, usually with a 403. Gydr does not publish a fixed list of IP addresses, so don't rely on an IP allowlist. The Custom Desk guide lists what to change for each Cloudflare protection setting; the same steps apply to webhook and callback endpoints: Let Gydr's requests reach your code.

Contact

To report a problem with GydrBot traffic, contact Gydr.