Agent Ready Crawlers

The field guide to every AI crawler and agent at the door, and the vendors who decide who gets in.

Head-to-head

Skyfire vs Cloudflare

In short

Skyfire tokens ride in a kyapay-token header and are verified against Skyfire's JWKS; Cloudflare verifies Web Bot Auth signatures from a Signature-Agent key directory. On per-purpose policy the rubric grades Skyfire not its job and Cloudflare yes, and on charging the rubric grades Skyfire yes and Cloudflare partial.

The sourced difference

Skyfire tokens ride in a kyapay-token header and are verified against Skyfire's JWKS; Cloudflare verifies Web Bot Auth signatures from a Signature-Agent key directory. Skyfire documents enforcing its tokens on Cloudflare with a Worker. Source, read 2026-11-04.

Side by side

QuestionSkyfireCloudflare
Tells a verified agent from a spoof Yes
KYA JWTs that sites verify via Skyfire's JWKS; not a bot manager itself		 Yes
Web Bot Auth signatures, IP validation, verified bot and signed agent directory (BotBase)
Per-purpose policy (train, search, answer, act) Not its job
sellers decide access from token claims such as agent and principal identity		 Yes
separate Search, Training and Agent controls on all plans, plus Disallow AI Training since 2026-09-15
Charging for access Yes
pay and kya-pay tokens charged by sellers, settled between Skyfire wallets		 Partial
Pay per crawl with HTTP 402, Cloudflare as Merchant of Record, private beta
Lets signed commerce agents through Yes
KYAPay carries identity plus payment intent; card payment flow documented		 Partial
Visa TAP and Mastercard Agent Pay built on Web Bot Auth, managed rulesets announced Oct 2025; current rule name not confirmed in docs (checked 2026-11-04)
Cost not published (checked 2026-11-04) free tier covers AI Crawl Control; Pro from USD 20/month; Bot Management and BotBase are Enterprise and sales-led
Reporting Not published
on pages read (checked 2026-11-04)		 Yes
AI Crawl Control analytics on crawler activity, request patterns and robots.txt compliance
Where it runs either: sellers verify tokens in their backend, in a Cloudflare Worker, or through partner bot managers (F5, Akamai, Fastly) edge: enforced on Cloudflare's reverse proxy, no app code needed
Points, rank6 of 10, rank 6 (tied)8 of 10, rank 1 (tied)
Price read 2026-11-04no public fee schedule found on homepage or docs index (checked 2026-11-04)AI Crawl Control and the Search, Training and Agent controls are on all plans including Free (USD 0). Pro USD 20/month billed annually or USD 25 monthly; Business USD 200/month annually or USD 250 monthly; Enterprise Bot Management and BotBase are sales-led. Pay per crawl prices are set by the site owner (private beta).

Verdicts by reader

Platform engineer
You can run both: Cloudflare for identity at the edge, a Worker for Skyfire tokens.
Security engineer
Different trust anchors: one issuer (Skyfire) versus each operator's own keys (Web Bot Auth).
Publisher operations
Skyfire carries committed funds; Cloudflare pay per crawl uses its own billing.

What each does not do

Skyfire

  • Does not detect or block unsigned bots; it only issues and settles tokens that sites or bot managers must check (docs).
  • KYA tokens alone cannot be charged; only pay and kya-pay tokens move money (introduction docs).
  • No published fee schedule (homepage and docs read 2026-11-04).

Cloudflare

  • BotBase does not block traffic itself; mitigation needs Security rules or AI traffic options (BotBase docs, updated 2026-10-08).
  • Disallow AI Training cannot pass a no-training preference to Bing until Microsoft ships robots.txt support, targeted early 2027 (Cloudflare blog, 2026-09-15).
  • Web Bot Auth verification does no nonce validation today; Cloudflare relies on short expires values (Web Bot Auth docs).
  • Pay per crawl is not self-serve: the docs (updated 2026-07-28) tell site owners to reach out to Cloudflare to join the beta.

More: alternatives to Skyfire, alternatives to Cloudflare.

Sources

Last reviewed 2026-11-04