Dvina's browser visits websites for one person at a time, when that person asks Dvina for something that takes a real browser. This page is for website owners: what the browser does, how to recognize its requests and how to allow or block it.

What it is

Dvina is a personal assistant. When someone signed in to Dvina asks for a job that takes a website, like comparing offers or filling in a form they asked for, Dvina can do it in a browser of its own, on that person's Dvina computer. It's a desktop Chromium with a window, not a headless browser, and the person can watch it live and take it over at any time.

  • It acts for one person. Each browser belongs to one signed-in Dvina user and works on what that person asked for.
  • It isn't a crawler. There's no list of sites it visits on its own. It opens the pages a task needs, one step at a time: it loads a page, reads it, then acts on it, the way a person does.
  • Never used to train models. What Dvina's browser reads on your site is used only for the request of the person it works for. It never trains an AI model.
  • It leaves the person's own decisions to them. It doesn't type passwords or card details. When a page needs the person to sign in or pay, Dvina stops and asks them to take over. Personal details, sending, paying and deleting wait for the person's OK.
  • It doesn't solve human verification. When it meets a check that a person is browsing, like Cloudflare's check, Turnstile, reCAPTCHA or hCaptcha, it doesn't click it, solve it or reload it. When a check clears by itself, Dvina waits for it. When it stays, the work stops, and the person takes over the browser, passes the check and hands it back.

Recognize its requests

Dvina's browser signs every http and https request it sends with Web Bot Auth, HTTP message signatures (RFC 9421) with an Ed25519 key. Each request carries three headers:

Signature-Agent: "https://api.dvina.ai"
Signature-Input: sig1=("@authority" "signature-agent");created=<unix time>;expires=<created + 60>;keyid="<key id>";alg="ed25519";nonce="<random>";tag="web-bot-auth"
Signature: sig1=:<Ed25519 signature>:
  • Signature-Agent names Dvina, the origin where its keys are published.
  • Signature-Input covers the request's @authority (your host) and the Signature-Agent header. The tag is web-bot-auth.
  • Each signature is valid for 60 seconds, from created to expires.
  • keyid is the key's JWK thumbprint (RFC 7638).

The browser sends Chromium's own user agent, the same as any Chromium on Linux, for example:

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/155.0.0.0 Safari/537.36

Its Chrome version moves with Chromium's updates, and the user agent says nothing about Dvina. Recognize Dvina by its signature, not its user agent.

Note

With the desktop app, a person can also let Dvina use a browser on their own computer. That browser doesn't sign its requests and looks like the person's own browsing.

Verify a signature

Dvina publishes its public key at its key directory:

https://api.dvina.ai/.well-known/http-message-signatures-directory

The directory answers with Content-Type: application/http-message-signatures-directory+json and a JSON Web Key Set with Dvina's Ed25519 public key. The answer is signed with the same key, with tag="http-message-signatures-directory".

If your site is on Cloudflare, Cloudflare verifies signed agents for you. To verify a request yourself:

  1. Check that Signature-Agent is "https://api.dvina.ai" and that Signature-Input has tag="web-bot-auth".
  2. Check that the time now is between created and expires.
  3. Get the key directory and pick the key whose JWK thumbprint matches keyid.
  4. Build the signature base from @authority, signature-agent and the signature parameters, as RFC 9421 describes, and verify the Signature with that Ed25519 key.

Anyone can send these headers. Treat a request as Dvina's only when its signature verifies against Dvina's key directory.

Allow or block it

Dvina's browser acts in real time for one person: the kind of traffic Cloudflare's Agent preset covers. If your site is on Cloudflare:

  • AI bot policies: In Security Settings, choose Configure AI bot policies. For Agent, choose Allow (do not block), Block on pages with ads or Block (on all pages).
  • WAF custom rules: Requests from verified bots and signed agents have cf.client.bot (cf.bot_management.verified_bot with Bot Management) set to true. Use it in a custom rule to skip, challenge or block them.
  • Verified bots directory: See the agents Cloudflare verifies in Cloudflare Radar.

Anywhere else, verify the signature as described above, then allow or block requests whose verified Signature-Agent is "https://api.dvina.ai".

Contact us

Questions about Dvina's browser on your site, or a request that didn't behave as this page describes? Email support@dvina.ai with your site's address and, if you have them, the time and the keyid of the requests.