How do I verify an OpenAI crawler request?

Definition: Verifying an OpenAI crawler request means checking whether its source IP address belongs to a range OpenAI publishes for the agent named in the request. An IP range is a block of network addresses.

Key facts

• As of 17 October 2026, OpenAI's crawler documentation identifies OAI-SearchBot as its search agent and links separate address lists for OAI-SearchBot, GPTBot and ChatGPT-User.
• The OAI-SearchBot address list stores network ranges under prefixes, with entries such as ipv4Prefix.
• The GPTBot address list uses the same structure, so checks can select a file according to the claimed agent.
• The ChatGPT-User address list provides ranges for requests bearing that agent name.

Which address should be checked?

The User-Agent request header identifies the software a request claims to use. Treat that name as the starting point for verification. Google's crawler verification guidance describes the problem of visitors claiming to be a crawler operator and recommends matching request addresses against published ranges for automated checks. Applying that approach here means using OpenAI's lists.

A reverse proxy is an intermediary that forwards a request to the website's server. Behind one, the connection address can belong to the intermediary. Apache's mod_remoteip documentation explains how a trusted proxy can supply the original client address. Its %a log field records the overridden client address, while %{c}a retains the underlying connection address. Apache warns that this behavior requires trusted intermediaries because a remote client can impersonate another address.

For an installation using that module, the comparison therefore uses the client address obtained through the configured trust relationship. An arbitrary forwarded header is insufficient evidence.

How is an address compared with the published ranges?

OpenAI's searchbot.json contains this example entry inside its prefixes array:

{"ipv4Prefix": "104.210.140.128/28"}

The slash notation describes a network and its prefix length. Python's ipaddress introduction explains that the prefix determines which leading address bits must match. Its address in network operation tests membership in that block.

The following implementation downloads the search list and checks an address. The sample address must be replaced with the request address from a trusted log. It prints matching ranges; an empty list means the address fails this comparison. It is an example implementation of the membership test.

curl -sL -A "Mozilla/5.0" https://openai.com/searchbot.json -o searchbot.json
python3 - <<'PY'
import ipaddress
import json

address = ipaddress.ip_address("104.210.140.128")
with open("searchbot.json") as file:
    data = json.load(file)
ranges = [ipaddress.ip_network(item["ipv4Prefix"])
          for item in data["prefixes"]]
print([str(network) for network in ranges if address in network])
PY

For GPTBot or ChatGPT-User, the download URL and local filename must correspond to that agent's list. This example reads the ipv4Prefix entries shown in the published files. Recording the file’s creationTime value alongside the result ties the comparison to the downloaded list.

Related terms

• OAI-SearchBot
• GPTBot
• ChatGPT-User
• Server log analysis
• User-agent spoofing

FAQ

Does a matching address prove that ChatGPT used my page in an answer?

A match establishes that your recorded address falls within a range in the selected list. The published search ranges contain address prefixes; determining how a particular answer uses content requires separate evidence.

Should I require an exact user-agent version?

OpenAI's crawler documentation says example version numbers may change. Use the agent name to choose the address list and check your request address against its ranges.

Is ChatGPT-User an automatic crawler?

The same OpenAI documentation describes ChatGPT-User as serving user actions and says it does not crawl the web automatically. For verification, use its separate address list when that name appears in your logs.

Sources

1. OpenAI, "Overview of OpenAI Crawlers", undated
2. OpenAI, "OAI-SearchBot published IP addresses", 2 January 2026, creationTime
3. OpenAI, "GPTBot published IP addresses", 22 September 2026, creationTime
4. OpenAI, "ChatGPT-User published IP addresses", 7 October 2026, creationTime
5. Google, "Verify requests from Google crawlers and fetchers", 20 March 2026
6. Apache Software Foundation, "mod_remoteip", undated
7. Python Software Foundation, "An introduction to the ipaddress module", undated

---

Check how a page reads to answer engines. Open the GEO score analyzer