Skip to content

Aiory bots

This page documents the automated requests Aiory sends, what they are for, how to verify them cryptographically, and how to control or block them.

Deutsche Fassung: aiory.app/bot?lang=de

1. Operator

All requests described here are operated by:
Aiory
c/o POSTFLEX PFX-837-041
Emsdettener Strasse 10
48268 Greven, Germany

Contact for site owners, blocking requests and complaints: kontakt@aiory.app
We usually reply within 3 business days.

2. Our bots and their purposes

We deliberately separate purposes into distinct tokens so you can allow or block them individually. A page fetched because a human just asked for it is not the same thing as an index crawl, and you should be able to decide on them separately.

All tokens belong to Aiory (aiory.app).

robots.txt token Purpose Triggered by
AioryBot Building our own search index. scheduled, background
AioryBot-User Fetching a single page because a user just asked for it – a URL pasted into the chat, or a source for their question. a human, in real time
AioryShopDiscovery Discovering product and price data for price comparison (sitemaps, schema.org structured data). scheduled, background
Aiory Descriptive short name for providers that require a descriptive user agent with contact details (e.g. Wikimedia). as above, depending on context

Full user agent strings:

Mozilla/5.0 (compatible; AioryBot/1.0; +https://aiory.app/bot)
Mozilla/5.0 (compatible; AioryBot-User/1.0; +https://aiory.app/bot)
Mozilla/5.0 (compatible; AioryShopDiscovery/1.0; +https://aiory.app/bot)
Aiory/1.0 (+https://aiory.app/bot; kontakt@aiory.app) python-httpx

We do not rotate user agents and we do not impersonate browsers. Our requests are always identifiable as automated.

3. What we use content for – and what we do not

We operate Aiory (aiory.app), an assistant that answers questions and cites and links its sources. Fetched pages serve exactly that purpose: answering a question and making the origin of the answer visible. Our signature directory states this purpose in machine-readable form ("purpose": "rag").

We do not train language models on the content we fetch. We operate no training-data crawler and we do not pass fetched content to third parties as training material.

We store an extract of the page so we can answer the same question later without fetching it from you again – this reduces the load on your server. We display your content only as a short extract with title, attribution and a link to the original.

4. How to verify it is really us

Anyone can claim a user agent. That is why we identify ourselves cryptographically.

Web Bot Auth (preferred)

We sign user-triggered fetches (AioryBot-User) per RFC 9421 (HTTP Message Signatures, tag web-bot-auth) using an Ed25519 key. The public half is published at:

https://aiory.app/.well-known/http-message-signatures-directory

These requests then carry these headers:

Signature-Agent: sig="https://aiory.app"
Signature-Input: sig=("@authority" "signature-agent");created=...;expires=...
                 ;keyid="...";alg="ed25519";tag="web-bot-auth"
Signature:       sig=:<base64>:

Verify the signature and you know for certain, independent of IP address and user agent. This mechanism is evaluated in production by Cloudflare, Akamai, AWS WAF, HUMAN, Vercel and DataDome, among others.

IP addresses

In addition, our bots fetch exclusively from these addresses, each labelled with the job it does so you can treat the two separately. Machine-readable at aiory.app/bot/ips.json:

89.58.33.12        index and product crawl    (AioryBot, AioryShopDiscovery)
152.53.181.87      user-triggered fetches     (AioryBot-User)
185.170.114.63     link previews, signed      (AioryBot-User)

Reverse DNS

Both addresses resolve back to a name under aiory.app, and that name points to the same address again:

89.58.33.12    → crawl.aiory.app
152.53.181.87  → fetch.aiory.app

This list is short and changes rarely. Should it change, we publish the update here before the new address goes into service.

5. How to control or block us

We honour robots.txt – for all four tokens, without exception. Changes take effect on our side within one hour at the latest.

Block the index crawl, keep allowing user-triggered fetches:

User-agent: AioryBot
User-agent: AioryShopDiscovery
Disallow: /

Block everything:

User-agent: AioryBot
User-agent: AioryBot-User
User-agent: AioryShopDiscovery
User-agent: Aiory
Disallow: /

Exclude only specific areas:

User-agent: AioryBot
Disallow: /internal/
Disallow: /search
Allow: /

Prefer writing to configuring? An email to kontakt@aiory.app is enough – we will exclude your domain on our side. The same applies if you want already-stored extracts of your pages deleted.

6. How we behave

  • At most one request per second per domain. We work across many different domains in parallel, not across many pages of one domain.
  • If your server signals overload or throttling, we stop fetching from you for the current run – we do not keep hammering.
  • We fetch robots.txt using our own token and cache it for one hour.
  • We follow sitemaps and structured data wherever you offer them – cheaper for both of us than guessing.
  • We do not circumvent paywalls, logins or technical access controls.
  • We do not use residential proxies or rotating identities.

7. Last updated

This information was last updated on 31 October 2026 and is always available at aiory.app/bot.