What RyeBot does
RyeBot is Rye's web agent that performs checkout flows on behalf of shoppers, retrieving offers and placing orders on merchant sites. It includes RyeBot/1.0 in its user-agent string. It implements Web Bot Auth and cryptographically signs its requests, publishing its public keys at https://rye.xyz/.well-known/http-message-signatures-directory. Developers integrating with Rye's API do not need to allowlist RyeBot.
How to control RyeBot
Target RyeBot in your robots.txt with the RyeBot token. Rules apply per bot, so you can allow this one while blocking others, or the reverse.
Allow RyeBot
User-agent: RyeBot
Allow: /Block RyeBot
User-agent: RyeBot
Disallow: /RyeBot signs its requests under Web Bot Auth, so sites can verify that the Signature-Agent header matches https://rye.xyz and validate the signature per RFC 9421 against the public keys at https://rye.xyz/.well-known/http-message-signatures-directory.
How to identify RyeBot
Temso identifies RyeBottraffic by matching the request's User-Agent header against this pattern. User-agent strings can be spoofed, so treat a match as an indication, not proof.
RyeBotRyeBot FAQ
What is RyeBot?
RyeBot is Rye's web agent that performs checkout flows on behalf of shoppers, retrieving offers and placing orders. It identifies itself with RyeBot/1.0 in the user-agent string and signs its requests under Web Bot Auth.
How do I block RyeBot?
You can address it in robots.txt with a group starting "User-agent: RyeBot" followed by "Disallow: /", but Rye's documentation does not state whether the agent honors robots.txt, and its requests happen when a shopper checks out through Rye. Since RyeBot signs its requests per RFC 9421 with keys published at https://rye.xyz/.well-known/http-message-signatures-directory, you can also identify and filter its traffic at the server or CDN level.
About Operational Bots
Monitoring, security scanning, link previews, webhooks, and feed fetchers: the utility traffic that keeps integrations and shared links working.
Most of this traffic is service-critical or user-triggered. Webhooks and previews don't follow robots.txt, and blocking them tends to break things you rely on.
