Google-Agent

Google-Agent user-agent strings

Mobile agent (source):

Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/W.X.Y.Z Mobile Safari/537.36 (compatible; Google-Agent; +https://developers.google.com/crawling/docs/crawlers-fetchers/google-agent)

Desktop agent (source):

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko; compatible; Google-Agent; +https://developers.google.com/crawling/docs/crawlers-fetchers/google-agent) Chrome/W.X.Y.Z Safari/537.36

Match on Google-Agent; the rest of the string changes between versions.

Verifying it's really Google-Agent

Google-Agent uses IP ranges from user-triggered-agents.json. Google also documents a DNS check: run a reverse DNS lookup on the IP, confirm the hostname ends in google.com or googleusercontent.com, then run a forward lookup on that hostname and confirm it returns the same IP. Some requests are also signed with Web Bot Auth as https://agent.bot.goog, with public keys at agent.bot.goog/.well-known/http-message-signatures-directory. Google does not sign every request, so fall back to the IP or DNS check when there is no signature.

How Airglow identifies it

• SignedIt can sign its requests (Web Bot Auth), so its identity can be verified.
• DeclaredIt names itself in the User-Agent: Google-Agent.

Every visit in Airglow says which of these applied, so you can decide how much to trust it.

Seeing it on your site

It runs JavaScript, so the Airglow script sees and labels it. Its visits are counted but not replayed.

What the script and a server connection each see

Allowing or blocking Google-Agent

It has no robots.txt token: it browses for a person, the way their own browser would. If your bot protection blocks it, the person it works for gets nothing back. Airglow shows where that happens, so you can let verified agents through.

Why the user agent contains Chrome

Both Google-Agent strings are full Chrome user agents, with the version written in Google's docs as Chrome/W.X.Y.Z. The real version number changes over time, so don't match on it. The stable part to match is the Google-Agent token, which appears in both the mobile and desktop strings.

Web Bot Auth signatures (experimental)

Google calls its Web Bot Auth use experimental. Signed requests carry a Signature-Agent header set to g="https://agent.bot.goog". Verify the Signature and Signature-Input headers labeled g under RFC 9421.

• Fetch the key set from the directory and cache it according to its Cache-Control header.
• Delete cached keys that no longer appear in the directory, since they may be expired or revoked.
• Check each signature's expiry window separately from the key set's cache lifetime.

How it differs from Googlebot

Googlebot crawls on its own schedule for Google Search and follows robots.txt. Google-Agent runs only when a user asks an agent to do something. It uses a different IP list and a different user agent token, so rules written for Googlebot do not cover it.

Questions

Other agents from Google

• GooglebotCrawler, training and search
• Google-ExtendedCrawler, training

Sources

• Google: List of Google user-triggered fetchers (Google-Agent)
• Google: Authenticate requests with Web Bot Auth (experimental)
• Google: Verify requests from Google crawlers and fetchers
• Google: user-triggered-agents.json IP ranges
• agent.bot.goog key directory

Last reviewed November 10, 2026.