> ## Documentation Index
> Fetch the complete documentation index at: https://docs-test.rye.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# RyeBot Allowlisting

> How merchants can allowlist RyeBot, the automated agent Rye uses to retrieve offers and place orders.

This documentation is for merchants who want to understand what `RyeBot` is and how to allowlist it.

<Check>
  Developers integrating with our API to add shopping functionality to their apps do not need to allowlist `RyeBot`.
</Check>

## What is `RyeBot`?

`RyeBot` is Rye's web agent that performs checkout flows on behalf of shoppers.

Allowlisting RyeBot ensures it can access your ecommerce site without being blocked by security measures, helping provide a smooth shopping experience for users relying on Rye’s services.

## How can I identify `RyeBot`?

To help website owners identify this bot on their websites, we provide an identification detail as part of our access requests ("RyeBot/1.0") in the user-agent string. Such identification detail may look like the following:

```
Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Firefox/38.0 (compatible; RyeBot/1.0)
```

RyeBot is also compliant with the [Web Bot Auth](https://datatracker.ietf.org/wg/webbotauth/about/) scheme, and signs its requests. Public keys for verifying traffic from RyeBot are available [here](https://rye.xyz/.well-known/http-message-signatures-directory).

## Vercel

If you are using Vercel, no additional configuration is needed to allow `RyeBot` to access your site. Vercel has added `RyeBot` to their [Verified Bot Directory](https://bots.fyi/d/ryebot), and Vercel's system automatically permits our requests by default.

## HUMAN

`RyeBot` is a trusted AI Agent in HUMAN’s Known Bots & Crawlers. After allowing `RyeBot` in HUMAN, no custom signature verification is required because HUMAN handles the verification for you.

To allow it in Sightline:

1. In your HUMAN console, go to Policies → Traffic Policy Settings → Known Bots & Crawlers.
2. Search for `RyeBot`.
3. Change the rule to ON and set the rule response to Allow.

To allow it in AgenticTrust:

1. In your HUMAN console, open Policies → AI Agents Permissions.
2. Search for `RyeBot`.
3. Grant the "Checkout" permission.

## Akamai

`RyeBot` is  an [Akamai-validated bot](https://techdocs.akamai.com/cloud-security/docs/detection-methods), but merchants need to opt-in to allow `RyeBot` to work on their website.

1. In your Akamai Security Configuration, open the Security Policy for your website and select Bot management, then click Custom Bot Categories. Under settings, select Manage Bot Categories.
2. Add a new bot category. Within it, create a new bot, and select Type: `Akamai-Defined` and Bot name: `RyeBot`.
3. Return to Custom Bot Categories and set the action of the new bot category to `Allow`.

## Other CDNs

If you are using another CDN that has not already verified `RyeBot`, you can still trust `RyeBot`traffic by checking the request headers:

* Verify the `Signature-Agent` header exactly matches `"https://rye.xyz"`, including the quotation marks.
* Fetch the public key associated with the signature from our [well-known endpoint](https://rye.xyz/.well-known/http-message-signatures-directory).
* Verify the authenticity of the `Signature` header based on RFC 9421.