What Is OAI-AdsBot? (OpenAI's ChatGPT Ads Crawler)

OAI-AdsBot is OpenAI's web crawler that validates ChatGPT ad landing pages, checking policy compliance and gathering content for ad relevance scoring when a page is submitted through Ads Manager. On April 23, 2026, OpenAI quietly added this fourth bot to its public crawler documentation. When you submit an ad, OAI-AdsBot may visit the landing page to check it. An advertiser may not learn the bot exists until an ad is rejected because an edge provider such as Cloudflare or Akamai blocked it before it reached the page.

This post walks through what OAI-AdsBot is and what it does, how it sits alongside the three other OpenAI crawlers (GPTBot, OAI-SearchBot, ChatGPT-User), how to verify that a visit really comes from OpenAI now that it publishes OAI-AdsBot's IP addresses, and a 6-step playbook to allowlist OAI-AdsBot correctly.

What OAI-AdsBot does and the one thing it does not do

OpenAI's bot documentation states OAI-AdsBot's purpose plainly: "OAI-AdsBot is used to validate the safety of web pages submitted as ads on ChatGPT. When you submit an ad, OpenAI may visit the landing page to ensure it complies with our policies." Validation runs on-demand. The bot only visits a landing page after the ad is submitted, not continuously.

A second function: relevance scoring. OpenAI continues, "We may also use content from the landing page to determine when it's most relevant to show the ad to users." The implication: your landing page's content (above-fold copy, headline match, schema markup) is an input to ad targeting, not just to ad approval. Treat the landing page as part of the ad creative, not as a separate destination.

Then the most advertiser-friendly clause in the entire bot documentation: "the data collected by OAI-AdsBot is not used to train generative AI foundation models." Of OpenAI's four documented crawlers, only OAI-AdsBot has this explicit training-exclusion guarantee. If you are worried about your content being absorbed into a future GPT model, OAI-AdsBot is the one OpenAI bot you can confidently allow. The training risk is GPTBot, not OAI-AdsBot.

The 4-bot OpenAI crawler taxonomy

Most "allow OpenAI bots" advice on the public web treats them as a single decision. They are not. OpenAI operates four documented crawlers, each with a different purpose, a different version, and a different recommended stance. Confuse them and you either block valuable retrieval traffic or invite training-data scraping you wanted to opt out of.

GPTBot - block by default

GPTBot collects training data for OpenAI's foundation models. Allow it only if you actively want your content included in future GPT training runs. Most B2B sites should block GPTBot in robots.txt and rely on OAI-SearchBot for ChatGPT visibility instead.

OAI-SearchBot - allow

OAI-SearchBot indexes pages for ChatGPT Search retrieval. Block this and you exit ChatGPT Search citations entirely. Note the user-agent format: this is the only OpenAI bot using the full Chrome 131 macOS string, which suggests it renders pages with full browser behavior more closely than the other three. For the deeper play on which OpenAI crawler to block and which to allow (and the edge-layer blocking that can silently break both), see the binary GPTBot vs OAI-SearchBot decision.

ChatGPT-User - allow

ChatGPT-User fires when a ChatGPT user explicitly asks the model to fetch a specific URL. The visit is user-initiated, so OpenAI notes that "robots.txt rules may not apply" for this bot. The user asked for the content directly. Blocking it breaks user-initiated browsing inside ChatGPT.

OAI-AdsBot - allow (or your ChatGPT ads break)

OAI-AdsBot is the bot this post covers. Block it and your ChatGPT ad campaigns will fail to validate. The data is not used for training, the visits are scoped to landing pages you have explicitly submitted, and the operational cost of blocking is high (rejected ads). Allow it.

How to verify OAI-AdsBot now that OpenAI publishes its IP addresses

When this post first ran in April 2026, OpenAI published IP range files for three of its crawlers: gptbot.json, searchbot.json and chatgpt-user.json. OAI-AdsBot had none, which left security teams no way to verify it by IP. That gap is closed. OpenAI's bot documentation now lists openai.com/adsbot.json as OAI-AdsBot's published IP addresses, and the file's own timestamp reads May 12, 2026.

It matters because of how Cloudflare, Akamai, Fastly, Imperva, and DataDome decide whether a request is a real bot or a spoofer. Their primary signal is IP. User-agent inspection is a hint; IP inspection is a verification.

With the file published, your WAF can now check that a request claiming to be OAI-AdsBot really comes from OpenAI by matching its source IP against adsbot.json, the same way it already could for GPTBot and OAI-SearchBot. Allowlisting by user-agent alone remains a trust assumption, because any client can put any string in the User-Agent header.

Two kinds of teams gain the most:

1. Conservative-on-bots advertisers who want to allow legitimate OpenAI traffic but block unverified scrapers. They no longer have to choose between letting some spoofed traffic through and blocking the real bot along with the spoofers.
2. WAF-managed sites at scale (large enterprises, agency-managed accounts) where security teams add allowlists by IP range as policy. Before adsbot.json existed they had nothing to add to the allowlist; now the rule can reference the published file.

OpenAI adds one caution in its crawler guidance for advertisers: because crawler infrastructure may change, do not rely only on IP addresses you happened to see in your logs. It recommends combining user-agent identification, verified bot programs where your provider supports them, firewall allowlists, robots.txt behavior and provider-level bot verification, and pointing any fixed IP allowlist at the published file. Step 5 of the playbook below shows the check.

Robots.txt: what OpenAI now documents for OAI-AdsBot

When this post first ran, OpenAI's bot documentation named robots.txt tokens for GPTBot and OAI-SearchBot, noted that robots.txt rules may not apply to user-initiated ChatGPT-User visits, and said nothing about OAI-AdsBot. Its developer page still names only GPTBot and OAI-SearchBot as robots.txt tags, but OpenAI's Help Center guidance for advertisers now covers OAI-AdsBot directly.

That guidance says, “You must allow OAI-AdsBot,” recommends allowing OAI-SearchBot too, and states that OpenAI crawlers respect robots.txt rules: if access is disallowed, “crawling will stop immediately.” Its own example uses User-agent: OAI-AdsBot with Allow: /.

So use User-agent: OAI-AdsBot, as OpenAI does. Capitalization does not matter: the robots exclusion standard (RFC 9309) requires crawlers to match user-agent names case-insensitively. Then confirm in your server and CDN logs that the bot actually reaches the page after you submit an ad.

If you also run a firewall or bot-protection service, robots.txt is only the first layer. OpenAI's guidance names two more layers that can block its crawlers: bot mitigation that returns 403 errors, and human-verification checks such as CAPTCHAs and JavaScript challenges. Steps 2 and 3 below cover the firewall layer; exempt OpenAI's crawlers from any CAPTCHA or JavaScript challenge too.

What this means for ChatGPT Ads advertisers

ChatGPT Ads has accelerated faster than any new ad platform in recent memory. Each step compresses the timeline.

The OAI-AdsBot documentation update (April 23) sits in the middle of an aggressive 25-day burst: self-serve launch April 10, $50K minimum cut April 13 (down from $200K), dashboard reveal April 21-22, bot documented April 23, all-US-advertisers + minimum removed entirely on May 5. The dashboard reveal post covers what the wizard surfaces; this post covers what happens after you click Submit.

In practical terms: you build a campaign in the Ads Manager, you submit a landing page URL, and OpenAI may send OAI-AdsBot to check it. If your WAF (Cloudflare, Akamai, Fastly, Imperva, DataDome) blocks the bot, the check fails. In Ads Manager the ad shows Not serving, and hovering over its status shows the reason. OpenAI's troubleshooting guide lists landing pages that block OpenAI's user agents or IP addresses among the common causes of a rejected ad. Our zero-impressions troubleshooting guide covers the crawler alongside every other level that can block delivery.

It is a common, avoidable reason new ChatGPT ads fail review. It is not your creative. It is not your bid strategy. It is your infrastructure refusing to let OpenAI verify the destination page. The May 5, 2026 removal of the account minimum opened the platform to every US advertiser, and OpenAI's self-service Ads Manager is now available to advertisers in more than 60 countries, so far more brands can hit this in their first days of testing. The 6-step playbook below prevents it.

How to allowlist OAI-AdsBot in 6 steps

This is the playbook. Each step is independent. Skip the steps that do not apply (no Cloudflare, no Akamai), but do not skip Step 5 (IP verification) and Step 6 (test with the Bot Access Checker).

Step 1. Add OAI-AdsBot to robots.txt

Add a User-agent block to your robots.txt with Allow: / so the crawler can fetch any landing page URL. This is the same block OpenAI uses in its own advertiser guidance, which also recommends allowing OAI-SearchBot.

# Allow OpenAI's ad-validation crawler (required for ChatGPT Ads)
User-agent: OAI-AdsBot
Allow: /

# OpenAI also recommends allowing its search crawler
User-agent: OAI-SearchBot
Allow: /

Step 2. Allowlist the user-agent in Cloudflare WAF

Cloudflare's Bot Fight Mode and Super Bot Fight Mode may challenge or block OAI-AdsBot. If you use Super Bot Fight Mode, create a WAF custom rule that matches the user-agent and skips it. Bot Fight Mode is different: Cloudflare says custom rules cannot skip it, so if it is challenging OAI-AdsBot, switch it off.

# Cloudflare WAF Custom Rule

(http.user_agent contains "OAI-AdsBot/1.0")

Action: Skip
Skip:
  - All remaining custom rules
  - Super Bot Fight Mode

# Optional: log matched requests for verification
Log: Yes

Step 3. Allowlist in Akamai, Fastly, or other CDN edge

If you run a CDN beyond or instead of Cloudflare, repeat the user-agent allowlist there. Akamai Bot Manager, Fastly's signal sciences module, Imperva, and DataDome all treat unknown bots as suspicious by default and may block OAI-AdsBot before it reaches your origin.

Bot Category: Custom Allow List
Match: User-Agent header contains "OAI-AdsBot"
Action: ALLOW (bypass bot scoring)
Tag for analytics: openai-ads-validation

# Repeat the conceptual rule in your CDN of choice.
# The allowlist must live at the edge layer, not just the origin.

Step 4. Render landing-page content server-side

OAI-AdsBot's JavaScript execution capability is undocumented. JavaScript-only single-page apps may fail validation when the bot cannot execute client-side rendering. Render all above-the-fold landing-page content server-side or use SSR (server-side rendering). This eliminates the JS-execution risk entirely and is also a baseline AEO best practice for organic AI citation capture.

Step 5. Verify visits against OpenAI's published IP ranges

OpenAI publishes OAI-AdsBot's addresses at openai.com/adsbot.json as a list of IP ranges. When a request in your logs claims to be OAI-AdsBot, check that its source IP falls inside one of them. A match is OpenAI; anything else is a client borrowing the name. If your firewall supports IP lists, point the allowlist at the published file, not at addresses copied from your logs, since OpenAI warns its crawler infrastructure may change.

From a terminal, the check takes two commands:

# 1. Download OpenAI's published OAI-AdsBot IP ranges
curl -s https://openai.com/adsbot.json -o adsbot.json

# 2. Replace <SUSPECTED_IP> with the source IP from your access logs
python3 -c "import ipaddress,json; ip=ipaddress.ip_address('<SUSPECTED_IP>'); print(any(ip in ipaddress.ip_network(p.get('ipv4Prefix') or p.get('ipv6Prefix')) for p in json.load(open('adsbot.json'))['prefixes']))"

# True  = inside OpenAI's published OAI-AdsBot ranges
# False = not OpenAI, whatever the User-Agent header says

Step 6. Check robots.txt with the AI Bot Access Checker

Run your landing page URL through the free AI Bot Access Checker to confirm your robots.txt allows OAI-AdsBot and to see whether the site is served through Cloudflare. The checker reads robots.txt rather than fetching the page as OAI-AdsBot, so pair it with the IP check in Step 5. Re-test after every WAF, CDN, or DNS change, and especially before launching a new ChatGPT Ads campaign. Bot allowlists drift when teams update infrastructure, and the checker catches robots.txt drift before it costs you a campaign.

What can still go wrong

Even with all 6 steps complete, ad approval can still surface unexpected failures. Patterns to check:

What we don't know about OAI-AdsBot yet

Two questions this list started with in April are now answered: OpenAI publishes adsbot.json, and its advertiser guidance says its crawlers respect robots.txt. These are still open:

1. Revisit cadence. Does OAI-AdsBot crawl a landing page once at submission and never again? Re-crawl on a schedule? Re-validate when the page content changes? Unknown.
2. JavaScript execution. Does OAI-AdsBot execute JavaScript fully, partially, or not at all? Server-side rendering removes the question, but it would be useful to know definitively.
3. Failure communication. OpenAI says a rejected ad shows Not serving with a reason on hover, and lists blocked user agents or IP addresses among common causes. Whether that reason names a firewall block specifically, or reads as a general policy rejection, is not documented.

We will update this post as OpenAI clarifies any of these. If you have first-hand campaign data on validation failures, we want to hear about it.

The AI Visibility Lift: same crawler discipline, organic side

Allowlisting OAI-AdsBot is paid-side discipline. Allowlisting OAI-SearchBot, Anthropic's Claude-SearchBot, and Microsoft's Bingbot, and keeping Google's Googlebot unblocked, is organic-side discipline. The same crawler-taxonomy rigor applies to both surfaces. Most paid-only ChatGPT Ads guides skip the organic side entirely. Most organic AEO guides skip OAI-AdsBot entirely. Both miss the symmetry.

The simple version: every AI engine separates training crawlers from retrieval crawlers from user-initiated crawlers. The conservative-and-correct stance is the same across vendors. Block training crawlers (GPTBot, ClaudeBot, Google-Extended) unless you opt into training data inclusion. Allow retrieval crawlers (OAI-SearchBot, Claude-SearchBot, Bingbot, and Googlebot for Google's AI surfaces) unless you want to exit AI search citations. Allow user-initiated crawlers (ChatGPT-User, Claude-User, Perplexity-User) because the user explicitly asked. Allow ad-validation crawlers (OAI-AdsBot) because the alternative is broken campaigns.

One discipline, applied across both paid and organic. Mid-market B2B teams that get this right early will compound a year of advantage by the time the playbook becomes general knowledge.

Frequently Asked Questions

Related Reading

• ChatGPT Ads Just Opened to Every US Advertiser: What Marketers Should Do First
• AI Bot Access Checker (free tool)
• Google Ads to ChatGPT Ads Converter (free tool)
• How Do ChatGPT Ads Work? Format, Context Hints, and the AI Visibility Lift (October 2026 Update)
• How to Set Up a ChatGPT Ad Campaign in 8 Steps (September 2026)
• What Are ChatGPT Ads? The Complete Guide for 2026