Sign in Talk to us

For website owners

Aion Agent

Aion Agent is the assistant inside Aion, a business banking platform. It visits a website only when a signed-in Aion customer asks it to, usually to sign in to that customer's own account and read, download or fill in something there. This page explains how to recognise it and how to allow or limit it.

Name
Aion Agent
Operator
Aion Financial Technologies, Inc.
333 West San Carlos Street, Riverpark Tower, Suite 600, San Jose, CA 95110
Purpose
Does tasks a customer asks for on sites where the customer has an account
Identification
Web Bot Auth (signed HTTP requests)
Signature-Agent
"https://aiagent.aionfi.com"
Public keys
https://aiagent.aionfi.com/.well-known/http-message-signatures-directory
Contact
contact@aionfi.com

When it visits, and what it does

  • Only for a customer's own task. A customer starts every task, either right then or as a recurring task they set up and approved. One session per task. There is no general browsing.
  • The customer is in control. In a live session the customer watches and can take over at any moment. Sign-ins use the customer's own credentials, which they type or chose to save with Aion. Robot checks are always completed by the customer; Aion never solves them.
  • The customer decides what's binding. Payments, submissions and other binding actions wait for the customer's approval.
  • Not a crawler. Aion Agent does not crawl or index sites, and Aion does not use website content to train AI models. What it reads is used only for the customer's task.
  • Low volume. A handful of sessions a day across all customers.

How to recognise it

Every request Aion Agent's browser sends for a page, or for data the page loads, is signed with Web Bot Auth: HTTP Message Signatures (RFC 9421) with an Ed25519 key. A signed request carries three headers:

Signature-Agent: "https://aiagent.aionfi.com"
Signature-Input: sig1=("@authority" "signature-agent");created=…;keyid="…";alg="ed25519";expires=…;tag="web-bot-auth"
Signature: sig1=:…:
  • The public keys are at aiagent.aionfi.com/.well-known/http-message-signatures-directory. The directory response is itself signed. The keyid is the key's JWK thumbprint.
  • Each signature covers your site's host and the Signature-Agent value, and is valid for 60 seconds. Aion's signing key never leaves Aion's own servers.
  • Many bot-management services (Cloudflare, Akamai, AWS WAF, Vercel, HUMAN, Fingerprint and others) can check these signatures for you.

The browser itself

  • It is standard Chromium with its own user agent, which changes as Chromium updates. We don't add a bot name to the user agent: identify Aion Agent by its signature, not its user agent.
  • It does not hide that it is automated: navigator.webdriver is true. Aion does not use stealth tools, residential proxies or CAPTCHA-solving services.
  • It runs in Aion's cloud on AWS. Those addresses aren't dedicated to Aion Agent, so please don't allow or block it by IP address.
  • It acts for one customer at a time, like that customer's own browser, so it does not fetch or apply robots.txt. To limit it, use its signature.

Allowing or limiting Aion Agent

Your site's rules apply. You can allow requests that carry a valid Aion Agent signature, ask for an extra check, or block them. If you block Aion Agent, Aion tells the customer, and they can do the task themselves in their own browser.

Customers can also use Aion for Chrome, which helps inside their own Chrome tab, with their own session. Those requests come from the customer's browser and are not signed as Aion Agent.

Contact

Questions, a problem with Aion Agent's traffic, or a request about your site: contact@aionfi.com. Please include your site's address and, if you can, the time and the Signature-Input header of the request.

Aion Financial Technologies, Inc. · Last updated October 28, 2026