ExaBot
Exa's older token - the current one is ExaSearchBot, which is cryptographically signed rather than IP-verified.
Reference reviewed by Sona
This token is deprecated or superseded. Read the detail below before relying on a rule that names it - it may no longer match live traffic.
| Operator | Exa |
|---|---|
| Powers | Exa's AI search API, consumed by agents and AI apps |
| Purpose | Search & answers |
| User-agent token | ExaBot |
| Respects robots.txt | Yes |
Exa indexes the web for a search API built specifically for AI: agents, assistants, and retrieval applications call Exa to find and fetch pages. Being in Exa's index makes you discoverable to a whole ecosystem of AI apps through one integration rather than one at a time.
Two naming notes matter. First, Exa's current robots.txt product token is ExaSearchBot, not ExaBot - the crawler now identifies as ExaSearchBot/1.0 and points at crawler.exa.ai. If your rules name only ExaBot, add the newer token. Second, do not confuse either with the long-retired French search crawler Exabot operated by Exalead, which is unrelated.
Its robots.txt handling is more nuanced than most. Exa prioritizes rules written specifically for ExaSearchBot; failing that it follows directives aimed at major search engines, and only then the wildcard group. So a site with an Allow for Googlebot and a restrictive wildcard is treated as permissive - a fallback chain worth knowing before you assume your wildcard governs it.
Most notably, Exa is the first crawler in this directory to implement Web Bot Auth. Every request is cryptographically signed using HTTP Message Signatures (RFC 9421), carrying Signature, Signature-Input, and Signature-Agent headers, with Ed25519 public keys published at a well-known URL. Verification does not depend on the source IP at all, and Cloudflare and Akamai validate it automatically at the edge.
How ExaBot behaves
- Current traffic identifies as ExaSearchBot/1.0; ExaBot is the older token.
- Signs every request with HTTP Message Signatures (RFC 9421) under the Web Bot Auth scheme.
- robots.txt fallback chain: ExaSearchBot rules first, then major-search-engine rules, then wildcard.
- Validated automatically at the edge by Cloudflare and Akamai.
Full user-agent string
Mozilla/5.0 (compatible; ExaBot/1.0; +https://exa.ai)
Allow ExaBot
One allow rule makes your content discoverable to the many AI agents and applications that search the web through Exa's API.
User-agent: ExaBot Allow: /
Block ExaBot
You don't want programmatic AI applications retrieving your pages through a third-party search API.
User-agent: ExaBot Disallow: /
How to verify ExaBot
Cryptographic request signatures (Web Bot Auth)
Exa is the strongest verification story in this directory, and it does not involve IP lists at all. Every ExaSearchBot request is signed under HTTP Message Signatures (RFC 9421) following the Web Bot Auth scheme, carrying Signature, Signature-Input, and Signature-Agent headers. Exa publishes Ed25519 public keys at crawler.exa.ai/.well-known/http-message-signatures-directory, so you can validate a request independently of where it came from - which is the point, since IP feeds go stale and signatures do not. Cloudflare and Akamai already validate this at the edge.
Check an IP against this botCommonly confused with ExaBot
Both index for AI-native search, but Exa sells an API that other applications query, while You.com runs its own consumer answer engine.
Both are answer-oriented crawlers, but Exa's index is consumed by third-party agents rather than by one branded product.
ExaBot FAQs
Is the token ExaBot or ExaSearchBot?
ExaSearchBot is Exa's current robots.txt product token, and live traffic identifies as ExaSearchBot/1.0. ExaBot is the older identifier - if your rules name only ExaBot, add the newer token.
What is Web Bot Auth and why does it matter?
It is a scheme where the crawler cryptographically signs each request using HTTP Message Signatures (RFC 9421). Because the signature travels with the request, you can verify the bot regardless of its IP address - which solves the staleness problem that makes IP feeds fragile.
How does Exa handle my robots.txt if I have no ExaSearchBot rule?
It falls back in order: ExaSearchBot-specific rules, then directives aimed at major search engines, then the wildcard group. So a permissive Googlebot rule can grant access even where your wildcard is restrictive.
Is this the same as the old French Exabot?
No. That was Exalead's search crawler, long retired and entirely unrelated to Exa the AI search company.
Can ExaBot read your page right now?
Test any URL and see exactly what AI crawlers receive.