There is a single, checkable fact underneath every conversation about AI and search visibility: OpenAI will only surface a site in ChatGPT search if that site lets its search crawler in. Opt out and you are not ranked low, you are absent. For an agency, that fact is not a threat, it is a product. It is small, technical, easy to get wrong by accident, and it applies to every client you have. That is the exact shape of a service worth selling.
The plain-English version
ChatGPT search reads the web with a crawler called OAI-SearchBot. When a buyer asks ChatGPT a question and it answers with named, linked sources, those sources came from pages OAI-SearchBot was allowed to read. OpenAI is blunt about the flip side: a site opted out of OAI-SearchBot will not be shown in ChatGPT search answers (OpenAI's crawler docs). So the first job for every client is not clever, it is hygiene: make sure the door is open, confirm the bot walks through it, and prove it to the client.
The reason this matters commercially is that the door is closed on more sites than you would guess, and almost always by accident. A staging block that shipped to production. A security plugin that treats unknown bots as threats. A blanket "disallow everything" left over from a rebuild. None of those show up in a ranking report, because this is not a ranking problem. The client simply never appears in the answer, and nobody notices until you go looking.
What OAI-SearchBot actually is (and is not)
OpenAI runs several crawlers, and conflating them is the most common way agencies give clients wrong advice. Three matter for this conversation, and they are governed separately.
The distinction you must be able to explain in a client meeting: OAI-SearchBot is about being found, GPTBot is about being trained on. They are decoupled on purpose. A client can say yes to showing up in ChatGPT search and no to having their content used for training, and OpenAI's separate robots.txt controls make that a two-line change, not a philosophical debate. When a nervous client says "I don't want AI using my stuff," your job is to separate the two: they almost always still want to be found.
The technical version: the audit every client gets
Productize this as a fixed checklist you run identically on every property. The value is in the consistency, not in bespoke cleverness.
- Read the live robots.txt. Pull it from the production host, not a local copy. Confirm there is no line that disallows OAI-SearchBot, and no blanket User-agent: * Disallow: / that would catch it. A named group for OAI-SearchBot wins over the wildcard, so the fix is often to add an explicit allow.
- Confirm the crawler is real, not spoofed. Genuine OAI-SearchBot requests come from OpenAI's published ranges at openai.com/searchbot.json. Verify hits against that list before you trust your logs, and before you rate-limit anything at the edge.
- Check the edge, not just the file. A CDN, WAF, or bot-management rule can block OAI-SearchBot even when robots.txt is perfect. Cloudflare, Akamai, and friends ship bot fights that treat unfamiliar agents as hostile. The robots.txt can say yes while the firewall says no.
- Give it a day. OpenAI processes robots.txt changes in roughly 24 hours, so schedule verification for the next day rather than declaring victory on the same call.
- Log and prove it. Record server hits by user agent so you can show the client OAI-SearchBot is reaching real pages, on a real cadence. That log is your monthly report.
# Let ChatGPT search find and cite this site
User-agent: OAI-SearchBot
Allow: /
# Optional: allow live user-initiated fetches too
User-agent: ChatGPT-User
Allow: /
# Training is a separate decision. See the GPTBot article.
User-agent: GPTBot
Disallow: /That last block is the teaching moment. Allowing search while disallowing training is a legitimate, common client posture, and it is the clearest proof that you understand the difference between the crawlers. We take the training decision apart on its own terms in the GPTBot piece for agencies.
Turning the fact into a service line
The audit above takes a competent tech an hour per site the first time and minutes on recheck. Packaged, it becomes recurring revenue and a retention hook. Here is where the return is, ranked by how much client trust each move buys relative to the effort.
Price it as a small fixed onboarding line plus a monitoring retainer, or fold it into an existing SEO package as a named deliverable so it shows up on the invoice and in the QBR. The report writes itself from the logs, and the story is one every client understands: we keep you reachable by the tool your buyers now ask first.
Where the money actually is: recheck cadence
The audit is the wedge. The retainer is the recheck. Robots.txt files drift. Sites get replatformed, WAFs get reconfigured, a developer ships a staging block on a Friday. A client who was reachable in June can be invisible in September with no ranking change to warn anyone. Selling the one-time audit leaves the recurring value on the table. Sell the monitoring, and price the audit as the thing that earns the monitoring.
What the monthly report actually says
The retainer only survives if the client can feel it, and this is an easy service to make invisible precisely because when it works, nothing happens. The fix is a report that fits on one screen and tells a story a busy owner reads in ten seconds. It is not a data dump. It is a status, a trend, and a next action, per property.
- Access status, green or red, per property. "OAI-SearchBot: allowed and verified" on every site you manage. A single red line is the whole reason the report exists, and the moment it turns red is the moment your retainer pays for itself.
- The bot-hit trend. A small line showing OAI-SearchBot visits over the last few weeks. A healthy line is boring and reassuring. A line that falls off a cliff is an early warning you caught before the client lost visibility.
- What changed, and what you caught. "Site replatformed on the 12th; we re-confirmed access on the 13th." This is where you show the work that prevented a problem the client never saw.
- One next action, or "none." Either a recommendation ("add answer blocks to the top five service pages") or an honest "nothing needed this month," which is itself a valuable thing to be able to say with confidence.
That report reframes a technical chore as a channel you are actively defending. The client stops thinking of you as the vendor who edits a file and starts thinking of you as the team that keeps them reachable by the tool their buyers now open first. That is the difference between a line item that gets cut in a budget review and one that gets protected.
Selling it up: from checkbox to channel
The strategic pitch to a client who wants to grow the engagement is simple: ChatGPT search is a discovery channel, like organic search or the map pack, and it has the unusual property that it can be switched off by accident by their own developers or hosting provider. You are the standing guard on that channel. Framed that way, the monitoring is not overhead, it is insurance on a revenue source, and it opens the door to the higher-value work of actually getting cited, not just found.
The best agencies use this as the on-ramp to the deeper answer-engine work: once access is guaranteed and monitored, the natural next conversation is why a competitor gets named in ChatGPT answers and the client does not. That is a content and authority engagement, and it is worth far more than the monitoring line that earned the trust to propose it.
The mistakes that make an agency look bad here
- Confusing the crawlers. Telling a client "we blocked the AI bots for your privacy" and quietly removing them from ChatGPT search is a firing offense once they understand what happened. Always separate search from training.
- Trusting robots.txt alone. The file can say allow while the CDN says deny. Check the edge or you will report a fix that is not live.
- Declaring victory same-day. The roughly 24-hour processing window means a same-call "done" is a guess. Verify the next day.
- Trusting spoofable logs. Anything can send a User-Agent string that says OAI-SearchBot. Verify against the published IP ranges before you rate-limit or before you celebrate.
- Treating it as one-and-done. Access drifts. Without monitoring, you are selling a snapshot of a moving target.
One more thing worth telling clients plainly: this only gets more valuable over time. The share of buyers who start a hiring decision by asking an AI tool is rising, not falling, and every one of those buyers resolves their question against whatever the model can read today. A client who is reachable and monitored now compounds that position quietly for months, while competitors who never checked stay invisible without knowing it. The agencies that win this are not doing anything clever. They are doing the boring thing first, on every property, and keeping it that way while the channel grows underneath them.
What changes by client size inside your book
- Micro and solo clients (1 to 9): the whole engagement is often just the audit plus a light monthly check. High volume, low touch, easy to systematize. The owner-run version of this playbook is the micro-business piece.
- Small and mid clients (10 to 249): multiple pages, sometimes multiple locations, a marketing contact who wants a real report. This is where the monitoring retainer lands cleanly, and it maps to the growing-business piece.
- Mid-market clients (250+): governance, legal sign-off, a CDN team you do not control, and change windows. Your role shifts from doing to steering. That world is the mid-market governance piece.
What to charge, and how to package it
The pricing question answers itself once you frame the value correctly. You are not billing for editing a text file, which sounds like ten minutes of work and gets haggled down to nothing. You are billing for guaranteeing a client is present on a discovery channel their own developers can switch off by accident, and for catching it the day it breaks. That is insurance on a revenue source, and insurance is priced on the downside it prevents, not the effort it takes.
Three packaging patterns work, and which one fits depends on how you already sell.
- As a named line in an existing SEO or care plan. The lowest-friction option: add "AI search access monitoring" as an itemized deliverable in a retainer the client already pays. It raises the perceived value of the whole plan and it shows up in the quarterly review, so the client sees it working.
- As a fixed onboarding plus a small monthly. Charge a one-time audit fee to find and fix the access problems across a client's properties, then a modest recurring fee for the monitoring and the monthly report. The audit is the wedge; the monitoring is the annuity.
- As a productized one-time audit for prospects. For businesses not yet on retainer, sell a flat-fee AI visibility audit. It is a low-commitment first engagement that surfaces real problems, builds trust, and opens the door to the ongoing relationship. A prospect who learns they are invisible in ChatGPT is a prospect who takes your next call.
Whatever the shape, resist billing it purely by the hour. Hourly pricing anchors the client on effort, and the effort here is deliberately small. Anchor them on the outcome instead: reachable by the tool their buyers now open first, monitored so it stays that way, with a named human watching the channel. That is worth a real number, and it renews.
Being reachable by OAI-SearchBot gets a client into the room. Being the firm ChatGPT actually names is the next problem, and it is the same expertise-and-trust work we lay out in the answer engine optimization cornerstone. Access first, citation second, in that order.
Want us to run this across your client book with you, or white-labeled underneath you? Run discovery and we will scope it, or see how we partner with agencies in what we ship.
