Handle's verification bot
When someone links an online identity to their handle and asks us to verify it, Handle fetches the public evidence they point us to and checks it. Those requests come from the client below. This page explains what it is, so you can recognize it in your server logs.
The User-Agent
Every verification request sends this User-Agent header:
The number is the version of the verification client, not of any proof format. The link in the header points back to this page.
Why Handle fetches your page
Handle lets people prove they control online identities and resources, by evidence anyone can check rather than by asking you to trust us. A person who links, for example, a GitHub account, a website, or a social profile can publish a short proof on it and ask Handle to confirm it is there.
We only read public evidence the account owner pointed us to. We fetch it to confirm the proof and to re-check it later. We do not crawl your site, follow links across it, or collect anything beyond the specific resource named in the proof.
What the requests look like
- Read-only. The client sends
GETrequests. It never submits forms or changes anything. - Infrequent. A request happens when an account owner links or re-checks an identity, not on a crawl schedule. The owner can only trigger a few checks for one identity in a rolling ten minutes.
- Patient and bounded. Each request times out in a few seconds, reads only a small amount of the response, and stops. If you return
429with aRetry-After, the client honors it. - No redirect chasing. Redirects are not followed by default. Only a domain proof read follows a redirect, and only as its documented rules allow.
- Standard providers. Requests to a provider's own API, such as GitHub, follow that provider's documented interface.
Recognizing and contacting Handle
A User-Agent is not proof. Any client can send any User-Agent header, including this one. The string identifies traffic that Handle intends to send, but it cannot authenticate the source. Do not treat the header alone as evidence that a request truly came from Handle.
If you see this client and have a question, or you believe the traffic is unwanted or abusive, tell us. Email abuse@handle.pub, or use our abuse reporting page:
The reporting page is being built. Until it is live, the email address above reaches us.
Verified outbound IP addresses
There is no authoritative IP allowlist for Handle's verification traffic yet. Handle runs on Cloudflare, and verification requests leave over shared Cloudflare infrastructure rather than from stable addresses we can attribute to Handle alone. Publishing Cloudflare's shared ranges would be misleading: they carry traffic from many unrelated services, so they would neither confirm nor exclude Handle.
We are researching whether Handle can send all verification traffic from a small set of dedicated, exclusive addresses. If and when we can, we will publish the verified list here, with guidance on how it is kept current. Until then, treat any IP-based filtering as your own choice made without an official list from us.
Even with a published list, an IP address raises confidence but is not cryptographic proof: it tells you where a request appears to come from, not who sent it.