Web bot auth
Web bot auth is the approach of having an automated client prove its identity cryptographically when it makes a request, so a site can tell a named, accountable agent apart from anonymous traffic sending the same user agent string.
It exists because a user agent string is a claim, not a credential. Anything can send any string, which is why bot protection cannot safely trust one, and why blanket blocking has been the practical default for years.
Signed requests change the trade. A site can allow a client it can verify and keep blocking the traffic it cannot, instead of choosing between the two. Ottom takes the simpler version of the same posture: a published user agent, a fixed set of static egress addresses, and a page that lists both so a store owner can check.
Why it matters to a store
If you want agent traffic but not scraping, this is the direction the answer is coming from. In the meantime, an allowlist for the agents you have decided to admit does the same job by hand.