Register PeatedBot with Cloudflare Verified Bots

Problem

PeatedBot identifies itself as PeatedBot/1.0 (+https://peated.com/bot), but Cloudflare-backed sites can block it before the scraper reaches public catalog pages.

During the September 2026 official-catalog audit, Springbank returned the same Cloudflare 403 page for its catalog, sitemap, RSS feed, and WordPress API. A Chromium request was also blocked, so changing the user agent is not a reliable fix.

We want a transparent bot identity that Cloudflare can verify without impersonating a browser or exposing Peated user information.

Proposed work

Register PeatedBot with Cloudflare Verified Bots using Web Bot Auth:

• Generate a dedicated Ed25519 signing key. Store the private key only in deployment secrets.
• Publish the public key directory at https://peated.com/.well-known/http-message-signatures-directory.
• Sign scraper requests with Signature-Agent, Signature-Input, and Signature.
• Add the required headers to the shared scraper HTTP transport rather than individual site adapters.
• Document PeatedBot's purpose, user agent, contact address, request-rate behavior, and robots handling at https://peated.com/bot.
• Validate signed requests with Cloudflare's crawl test endpoint.
• Submit PeatedBot through Cloudflare's Bot Submission Form using Request Signature verification.
• Document key rotation and registration recovery.

Acceptance criteria

• No private signing key is committed or exposed by the public key endpoint.
• Outbound scraper requests can be signed and pass Cloudflare's Web Bot Auth format validation.
• PeatedBot is submitted to Cloudflare's Verified Bots directory.
• The public bot page explains what data Peated reads and how site owners can contact or block it.
• Existing unsigned scraper targets continue to work.
• A Cloudflare-backed catalog is tested after registration.
• If Springbank still blocks verified traffic, record that owner allowlisting is required rather than adding browser impersonation or proxy rotation.

References

• https://developers.cloudflare.com/bots/reference/bot-verification/web-bot-auth/
• https://developers.cloudflare.com/bots/concepts/bot/verified-bots/
• https://developers.cloudflare.com/bots/reference/bot-verification/ip-validation/

Start by locating the shared scraper HTTP transport and the implementation serving https://peated.com/bot, then review how deployment secrets and public well-known files are handled. Use Cloudflare's Web Bot Auth documentation and crawl test endpoint to validate the request format; done means signed requests work without breaking unsigned targets, the public bot information is complete, and the submission and catalog test outcomes are recorded.