The SkeletonKey bot
Operated by Skeleton Key (useskeletonkey.com) · hello@useskeletonkey.com
Skeleton Key is an escape room trip planner. When one of our users adds an escape room to a trip they're planning, our bot checks that room's public booking calendar so they can see which time slots are open while they build their itinerary. That's all it does. Every request traces back to a specific person who picked your room and is deciding when to visit.
What it fetches
Availability and booking-calendar endpoints for specific rooms that users are actively planning around: typically a handful of requests per room per day, only while the room is on someone's upcoming trip. It doesn't crawl sites, follow links, index content, or collect data for advertising or AI training. Every check is on behalf of a potential customer of yours; when they pick a slot, they book it on your own booking page.
How it identifies itself
Every request carries this User-Agent:
SkeletonKey/1.0 (+https://useskeletonkey.com/bot; hello@useskeletonkey.com)
Requests are additionally signed with Web Bot Auth (RFC 9421 HTTP message signatures). Our Ed25519 public key is published at /.well-known/http-message-signatures-directory, so any origin can cryptographically verify that a request claiming to be us really is. We don't publish a fixed IP range; signature verification is the reliable way to identify us.
Controlling the bot
We honor robots.txt directives addressed to us by name, including Crawl-delay, checked in code before every request. To block us entirely:
User-agent: SkeletonKey Disallow: /
We don't apply generic User-agent: * rules, though. Wildcard rules are written for search-engine crawlers, and this isn't crawling: each request is made on behalf of a specific person planning a visit (the same convention other user-triggered fetchers follow). Rules that name us always apply.
A block doesn't stop players from planning trips around your rooms; they just stop seeing your open times while they decide. If our traffic is causing a problem, we'd rather fix the problem than get blocked.
Prefer a different integration?
If there's a way you'd rather we get availability (an API, a feed, an authenticated endpoint, different rate limits, specific hours), tell us and we'll adopt it. We'd much rather integrate on your terms. Email hello@useskeletonkey.com and a human will reply.