What Is OAI-AdsBot? (OpenAI's ChatGPT Ads Crawler)

On April 23, 2026, OpenAI quietly added a fourth bot to its public crawler documentation. OAI-AdsBot validates the safety and relevance of every landing page submitted as a ChatGPT ad. Most advertisers will not learn it exists until their first campaign silently fails because Cloudflare or Akamai blocked the bot before it reached the page.

This post walks through what OAI-AdsBot is and what it does, how it sits alongside the three other OpenAI crawlers (GPTBot, OAI-SearchBot, ChatGPT-User), why the missing IP range file matters more than it looks, and a 6-step playbook to allowlist OAI-AdsBot correctly. The 5th step is one no other public reference covers: reverse DNS verification of suspected OAI-AdsBot visits.

What OAI-AdsBot does and the one thing it does not do

OpenAI's bot documentation states OAI-AdsBot's purpose plainly: "OAI-AdsBot is used to validate the safety of web pages submitted as ads on ChatGPT. When you submit an ad, OpenAI may visit the landing page to ensure it complies with our policies." Validation runs on-demand. The bot only visits a landing page after the ad is submitted, not continuously.

A second function: relevance scoring. OpenAI continues, "We may also use content from the landing page to determine when it's most relevant to show the ad to users." The implication: your landing page's content (above-fold copy, headline match, schema markup) is an input to ad targeting, not just to ad approval. Treat the landing page as part of the ad creative, not as a separate destination.

Then the most advertiser-friendly clause in the entire bot documentation: "the data collected by OAI-AdsBot is not used to train generative AI foundation models." Of OpenAI's four documented crawlers, only OAI-AdsBot has this explicit training-exclusion guarantee. If you are worried about your content being absorbed into a future GPT model, OAI-AdsBot is the one OpenAI bot you can confidently allow. The training risk is GPTBot, not OAI-AdsBot.

The 4-bot OpenAI crawler taxonomy

Most "allow OpenAI bots" advice on the public web treats them as a single decision. They are not. OpenAI operates four documented crawlers, each with a different purpose, a different version, and a different recommended stance. Confuse them and you either block valuable retrieval traffic or invite training-data scraping you wanted to opt out of.

GPTBot - block by default

GPTBot collects training data for OpenAI's foundation models. Allow it only if you actively want your content included in future GPT training runs. Most B2B sites should block GPTBot in robots.txt and rely on OAI-SearchBot for ChatGPT visibility instead.

OAI-SearchBot - allow

OAI-SearchBot indexes pages for ChatGPT Search retrieval. Block this and you exit ChatGPT Search citations entirely. Note the user-agent format: this is the only OpenAI bot using the full Chrome 131 macOS string, which suggests it renders pages with full browser behavior more closely than the other three. For the deeper play on which OpenAI crawler to block and which to allow (and the WAF default that silently breaks both), see the binary GPTBot vs OAI-SearchBot decision.

ChatGPT-User - allow

ChatGPT-User fires when a ChatGPT user explicitly asks the model to fetch a specific URL. The visit is user-initiated, so OpenAI notes that "robots.txt rules may not apply" for this bot. The user asked for the content directly. Blocking it breaks user-initiated browsing inside ChatGPT.

OAI-AdsBot - allow (or your ChatGPT ads break)

OAI-AdsBot is the bot this post covers. Block it and your ChatGPT ad campaigns will fail to validate. The data is not used for training, the visits are scoped to landing pages you have explicitly submitted, and the operational cost of blocking is high (silent ad rejection). Allow it.

The verification problem nobody is talking about

Compare the four bots' IP range files. GPTBot publishes openai.com/gptbot.json. OAI-SearchBot publishes openai.com/searchbot.json. ChatGPT-User publishes openai.com/chatgpt-user.json. OAI-AdsBot publishes nothing. Three of four. Not four of four.

This sounds like a small operational gap. It is not, because of how Cloudflare, Akamai, Fastly, Imperva, and DataDome decide whether a request is a real bot or a spoofer. Their primary signal is IP. User-agent inspection is a hint; IP inspection is a verification.

When OpenAI publishes an IP range file, your WAF can validate that a request claiming to be GPTBot or OAI-SearchBot really is from OpenAI by cross-referencing the source IP against the published range. Without an IP file, that verification is impossible. You can allowlist by user-agent string, but any client can put any string in the User-Agent header. Allowlisting OAI-AdsBot by user-agent alone is a trust assumption, not a verification.

This affects two distinct populations:

1. Conservative-on-bots advertisers who want to allow legitimate OpenAI traffic but block unverified scrapers. Without an IP file, you must accept either some spoofed traffic from any client claiming to be OAI-AdsBot, or the silent failure mode where your WAF blocks both spoofers and the real bot.
2. WAF-managed sites at scale (large enterprises, agency-managed accounts) where security teams add allowlists by IP range as policy. If they have nothing to add to the allowlist, the rule never gets approved, and the next ad campaign fails when the WAF rejects a UA-only request as suspicious.

The workaround until OpenAI publishes adsbot.json is reverse DNS. Resolve the source IP. Confirm the resulting hostname ends in openai.com. This catches user-agent spoofing while avoiding the brittleness of UA-only matching. It is also the only verification method you can ship today (Step 5 of the playbook below).

Robots.txt token: what OpenAI hasn't documented

Here is something you will not find in most OAI-AdsBot coverage. OpenAI's bot documentation explicitly names robots.txt token guidance for GPTBot and OAI-SearchBot. For ChatGPT-User, OpenAI notes that robots.txt rules may not apply given user-initiated browsing. For OAI-AdsBot, the documentation is silent. There is no formally documented robots.txt user-agent token.

The convention from the user-agent string is User-agent: OAI-AdsBot, matching the bot name. One competitor reference asserts oai-adsbot lowercase as the token. OpenAI's docs assert neither. This is a real gap, and pretending otherwise misleads readers.

The pragmatic recommendation: use User-agent: OAI-AdsBot in your robots.txt because it matches the documented user-agent string, then verify by submitting a real landing page through OpenAI's Ads Manager and watching your server logs for actual OAI-AdsBot hits. If the bot reaches your page, your token works. If it does not, try the lowercase variant. Treat your server logs, not internet advice, as the source of truth here.

When OpenAI updates the bot documentation to formally specify a token, update your robots.txt to match. We will update this post with the change.

What this means for ChatGPT Ads advertisers

ChatGPT Ads has accelerated faster than any new ad platform in recent memory. Each step compresses the timeline.

The OAI-AdsBot documentation update (April 23) sits in the middle of an aggressive 25-day burst: self-serve launch April 10, $50K minimum cut April 13 (down from $200K), bot documented April 23, dashboard reveal April 27, all-US-advertisers + minimum removed entirely on May 5. The dashboard reveal post covers what the wizard surfaces; this post covers what happens after you click Submit.

In practical terms: you build a campaign in the Ads Manager, you submit a landing page URL, and OAI-AdsBot crawls that URL within minutes to validate it. If your WAF (Cloudflare, Akamai, Fastly, Imperva, DataDome) blocks the bot, the validation fails. The failure is silent in the Ads Manager UI. Your campaign sits in pending review or quietly rejects, often without surfacing the WAF block as the cause.

This is the most common reason new ChatGPT ads fail to launch in May 2026. It is not your creative. It is not your bid strategy. It is your infrastructure refusing to let OpenAI verify the destination page. With the May 5 minimum removal opening the platform to every US advertiser, far more brands are now discovering this exact failure mode in their first few days of testing. The 6-step playbook below fixes it.

How to allowlist OAI-AdsBot in 6 steps

This is the playbook. Each step is independent. Skip the steps that do not apply (no Cloudflare, no Akamai), but do not skip Step 5 (reverse DNS verification) and Step 6 (test with the Bot Access Checker).

Step 1. Add OAI-AdsBot to robots.txt

Add a User-agent block to your robots.txt with Allow: / so the crawler can fetch any landing page URL. OpenAI documents the user-agent string but has not formally documented a robots.txt token; use the user-agent name directly.

# Allow OpenAI's ad-validation crawler
User-agent: OAI-AdsBot
Allow: /

# Note: OpenAI has not formally documented this robots.txt token.
# This convention follows the User-Agent string.

Step 2. Allowlist the user-agent in Cloudflare WAF

Cloudflare's default Bot Fight Mode and Super Bot Fight Mode may challenge or block OAI-AdsBot. Create a WAF custom rule that matches the user-agent and skips bot protection for matched requests.

# Cloudflare WAF Custom Rule

(http.user_agent contains "OAI-AdsBot/1.0")

Action: Skip
Skip:
  - All remaining custom rules
  - Bot Fight Mode
  - Super Bot Fight Mode

# Optional: log matched requests for verification
Log: Yes

Step 3. Allowlist in Akamai, Fastly, or other CDN edge

If you run a CDN beyond or instead of Cloudflare, repeat the user-agent allowlist there. Akamai Bot Manager, Fastly's signal sciences module, Imperva, and DataDome all treat unknown bots as suspicious by default and may block OAI-AdsBot before it reaches your origin.

Bot Category: Custom Allow List
Match: User-Agent header contains "OAI-AdsBot"
Action: ALLOW (bypass bot scoring)
Tag for analytics: openai-ads-validation

# Repeat the conceptual rule in your CDN of choice.
# The allowlist must live at the edge layer, not just the origin.

Step 4. Render landing-page content server-side

OAI-AdsBot's JavaScript execution capability is undocumented. JavaScript-only single-page apps may fail validation invisibly when the bot cannot execute client-side rendering. Render all above-the-fold landing-page content server-side or use SSR (server-side rendering). This eliminates the JS-execution risk entirely and is also a baseline AEO best practice for organic AI citation capture.

Step 5. Verify legitimate visits with reverse DNS

This is the step no other public reference covers. Without an OpenAI-published adsbot.json, you cannot verify OAI-AdsBot identity by IP allowlist. The next-best verification is reverse DNS: when you see a request claiming to be OAI-AdsBot in your access logs, reverse-resolve the source IP and confirm the resulting hostname ends in openai.com. Real OpenAI traffic resolves; spoofers do not.

In bash, this is one command per suspect IP:

# Replace <SUSPECTED_IP> with the source IP from your access logs

dig -x <SUSPECTED_IP> +short

# Look for output ending in .openai.com
# Example legitimate result:
#   bot-12-34-56-78.openai.com.
# Spoofers will return either no result or a non-openai hostname.

Step 6. Test access with the AI Bot Access Checker

Run your landing page URL through the free AI Bot Access Checker to confirm OAI-AdsBot can reach it. Re-test after every WAF, CDN, or DNS change, and especially before launching a new ChatGPT Ads campaign. Bot allowlists drift when teams update infrastructure. The checker catches drift before it costs you a campaign.

What can still go wrong

Even with all 6 steps complete, ad approval can still surface unexpected failures. The most common patterns:

What we don't know about OAI-AdsBot yet

The honest list of open questions, none of which OpenAI's current documentation answers:

1. Will OpenAI publish an IP range file (adsbot.json)? The other three bots have one. Publishing one for OAI-AdsBot would close the verification gap immediately. No public commitment from OpenAI to date.
2. Does OAI-AdsBot respect robots.txt directives? The bot documentation does not name a robots.txt token. The convention assumes it follows the user-agent string. We do not know definitively until OpenAI documents it or until field tests at scale prove it.
3. Revisit cadence. Does OAI-AdsBot crawl a landing page once at submission and never again? Re-crawl on a schedule? Re-validate when the page content changes? Unknown.
4. JavaScript execution. Does OAI-AdsBot execute JavaScript fully, partially, or not at all? Server-side rendering removes the question, but it would be useful to know definitively.
5. Failure communication. When OAI-AdsBot fails to validate a page, what does the advertiser see in the Ads Manager? Is "WAF blocked the bot" surfaced as a distinct error, or does it look like generic policy rejection? Anecdotal reports suggest the latter.

We will update this post as OpenAI clarifies any of these. If you have first-hand campaign data on validation failures, we want to hear about it.

The AI Visibility Lift: same crawler discipline, organic side

Allowlisting OAI-AdsBot is paid-side discipline. Allowlisting OAI-SearchBot, Anthropic's Claude-SearchBot, Microsoft's Bingbot, and Google's GoogleOther is organic-side discipline. The same crawler-taxonomy rigor applies to both surfaces. Most paid-only ChatGPT Ads guides skip the organic side entirely. Most organic AEO guides skip OAI-AdsBot entirely. Both miss the symmetry.

The simple version: every AI engine separates training crawlers from retrieval crawlers from user-initiated crawlers. The conservative-and-correct stance is the same across vendors. Block training crawlers (GPTBot, ClaudeBot, Google-Extended) unless you opt into training data inclusion. Allow retrieval crawlers (OAI-SearchBot, Claude-SearchBot, Bingbot, GoogleOther) unless you want to exit AI search citations. Allow user-initiated crawlers (ChatGPT-User, Claude-User, Perplexity-User) because the user explicitly asked. Allow ad-validation crawlers (OAI-AdsBot) because the alternative is broken campaigns.

One discipline, applied across both paid and organic. Mid-market B2B teams that get this right early will compound a year of advantage by the time the playbook becomes general knowledge.

Frequently Asked Questions

Related Reading

• ChatGPT Ads Just Opened to Every US Advertiser: What Marketers Should Do First
• AI Bot Access Checker (free tool)
• Google Ads to ChatGPT Ads Converter (free tool)
• How Do ChatGPT Ads Work? Format, Context Hints, and the AI Visibility Lift (May 2026 Update)
• How to Set Up a ChatGPT Ad Campaign in 8 Steps (May 2026)
• What Are ChatGPT Ads? The Complete Guide for 2026