# OptinStack-Bot

> OptinStack-Bot identifies authenticated OptinStack scans: user agent, robots.txt behavior, rate limits, Web Bot Auth keys, crawl scope, and abuse contact.

Page: https://optinstack.com/bot
Markdown: https://optinstack.com/llms.md/bot
JWKS: https://optinstack.com/.well-known/http-message-signatures-directory

OptinStack-Bot is the automated agent OptinStack uses when reading customer websites on behalf of authenticated workspace users. It is not a public web crawler and does not index the open internet.

It powers tracker scans, install verification, published-banner checks, and AI design sync in the OptinStack dashboard.
Requests use the OptinStack-Bot/1.0 (+https://optinstack.com/bot) user agent and Web Bot Auth signatures when signing keys are configured.

## User agent

```
OptinStack-Bot/1.0 (+https://optinstack.com/bot)
```

Optional purpose header: `X-OptinStack-Bot-Purpose` with values `scanner`, `verifier`, or `design-sync`.

## What it does

- Discovers pages from sitemaps (preferred) or homepage links before tracker scans.
- Loads pages in a real browser to inventory trackers and consent platforms.
- Fetches published HTML to verify OptinStack script installation.
- Reads public pages for AI-assisted banner theme sync.

See the [domain scan disclosure](https://optinstack.com/legal/domain-scans) for page selection, plan limits, access restrictions, and result variability.

## Crawl scope

- **Who initiates:** Only authenticated OptinStack workspace users (or automated jobs they enable for their projects).
- **What hosts:** Only hostnames registered on that customer project (for example their production site).
- **What paths:** Same-host URLs discovered from sitemap or homepage links, after robots.txt filtering, within the plan page limit.
- **What it does not do:** Open-web indexing, link graph discovery beyond the registered host, unsolicited bulk crawls, or advertising scrapes.

## robots.txt

OptinStack-Bot honors `robots.txt` directives for the `OptinStack-Bot` group and the `*` fallback group. Disallowed paths are excluded from scan URL discovery. When a site publishes `Crawl-delay`, OptinStack-Bot waits before fetching additional URLs from that host.

## Rate limits and security

- API admission controls per account and global concurrency for active scans.
- Queued browser segments with hard caps (not unbounded parallel crawls).
- HTTPS only for discovery and page loads.
- No credential stuffing, form submission for login walls, or intentional exploitation.
- Web Bot Auth signatures (when configured) prove the request came from OptinStack keys listed at the public JWKS directory.

## Verification (Web Bot Auth)

- Public directory: https://optinstack.com/.well-known/http-message-signatures-directory
- Signature-Agent: https://optinstack.com
- Category for Cloudflare Verified Bots: Monitoring & Analytics (Request Signature).

## Contact and abuse

Questions or abuse reports: [hello@optinstack.com](mailto:hello@optinstack.com).

Include UTC time, target URL, User-Agent, and Signature headers when reporting suspected misuse.

## FAQ

### What is OptinStack-Bot?

OptinStack-Bot is the user-agent identity for automated HTTPS requests OptinStack makes when an authenticated customer starts a domain scan, install verification, published-banner check, or AI banner design sync. It is not an open-web search crawler.

### What user agent does it send?

OptinStack-Bot sends: OptinStack-Bot/1.0 (+https://optinstack.com/bot). Optional purpose header: X-OptinStack-Bot-Purpose with values scanner, verifier, or design-sync.

### Does OptinStack-Bot honor robots.txt?

Yes. OptinStack-Bot honors robots.txt rules for the OptinStack-Bot user-agent group and the * fallback group. Disallowed paths are excluded from scan URL discovery. When a site publishes Crawl-delay, OptinStack-Bot waits before fetching additional URLs from that host.

### What is the crawl scope?

Only hostnames the customer has registered in their OptinStack workspace. URL discovery uses the site sitemap when available, otherwise homepage links, subject to plan page limits. OptinStack does not perform unsolicited bulk crawling of the public web.

### How is traffic rate limited?

Scans start only from authenticated OptinStack customers. The API enforces per-account and global concurrency caps on active scans. Browser runs are queued and batched; OptinStack does not open unbounded parallel crawls against a target host.

### How can operators verify requests?

Public signing keys for Web Bot Auth are published at https://optinstack.com/.well-known/http-message-signatures-directory. Signature-Agent is https://optinstack.com. OptinStack registers OptinStack-Bot with Cloudflare Verified Bots using Request Signature authentication in the Monitoring & Analytics category when the application is approved.

### Where do I report abuse or ask questions?

Email hello@optinstack.com. Include the request time (UTC), target URL, full User-Agent, and any Signature or Signature-Agent headers if present.