HiveFlow Agent

What it is

• A user-directed agent (an intermediary): it only visits a page because a HiveFlow user asked for a task that needs it. It is not a crawler and does not index or train on your content.
• It runs a real Chrome browser in an isolated cloud computer that belongs to the user's organization, one page at a time, at human-like speed.
• The user can watch the browser live and take over at any moment, for example to sign in themselves.

How it identifies itself

Navigation requests are signed with HTTP Message Signatures following the Web Bot Auth proposal, so you can verify that a request really comes from HiveFlow:

Signature-Agent

"https://api.hiveflow.ai"

Signature-Input tag

web-bot-auth (Ed25519, covers @authority and signature-agent, valid for 60 seconds)

Key directory

https://api.hiveflow.ai/.well-known/http-message-signatures-directory

Requests without a valid signature are not from this agent. HiveFlow never shares its signing key with the browser or with users.

How it behaves

• It does not solve, bypass or evade CAPTCHAs, bot challenges or other access controls. When a site shows one, the agent stops and asks the user to continue by themselves.
• It keeps request rates low (one task, one page at a time) and is rate limited per organization.
• It respects explicit blocks: if your site refuses the agent, it tells the user and does not retry with other identities.
• Before a final action such as submitting a form, an invoice or a payment, the assistant stops and asks the user to confirm in the chat; browser actions also need the user's permission.
• Each user has a separate browser profile; content is used to complete the task the user asked for.

How to allow or block it

If you use Cloudflare, the agent appears as a signed agent once it is verified, and you can allow or block it with your bot management rules. On any server you can verify or reject requests by checking the Signature-Agent header and the signature against the key directory above.