Head-to-head
Skyfire vs Stytch IsAgent
In short
Skyfire issues signed KYA and pay tokens that sellers verify against its JWKS; Stytch IsAgent is a front-end flag that Stytch says must not be used as a security control. On verifies agents the rubric grades Skyfire yes and Stytch IsAgent partial, and on per-purpose policy the rubric grades Skyfire not its job and Stytch IsAgent not published.
The sourced difference
Skyfire issues signed KYA and pay tokens that sellers verify against its JWKS; Stytch IsAgent is a front-end flag that Stytch says must not be used as a security control. Source, read 2026-11-04.
Side by side
| Question | Skyfire | Stytch IsAgent |
|---|---|---|
| Tells a verified agent from a spoof | Yes KYA JWTs that sites verify via Skyfire's JWKS; not a bot manager itself |
Partial Web Bot Auth signatures plus heuristic detection (user agent, TLS fingerprint, network traits) |
| Per-purpose policy (train, search, answer, act) | Not its job sellers decide access from token claims such as agent and principal identity |
Not published per-purpose policy (checked 2026-11-04) |
| Charging for access | Yes pay and kya-pay tokens charged by sellers, settled between Skyfire wallets |
Not published support (checked 2026-11-04) |
| Lets signed commerce agents through | Yes KYAPay carries identity plus payment intent; card payment flow documented |
Not published Visa TAP or Mastercard Agent Pay support (checked 2026-11-04) |
| Cost | not published (checked 2026-11-04) | published: IsAgent free to 10,000 calls/month; fingerprints USD 0.005 each beyond 10,000 |
| Reporting | Not published on pages read (checked 2026-11-04) |
Partial client hint with agent flag and identity, meant for analytics |
| Where it runs | either: sellers verify tokens in their backend, in a Cloudflare Worker, or through partner bot managers (F5, Akamai, Fastly) | app: client-side SDK calling Stytch's API, plus backend Lookup API for fingerprinting |
| Points, rank | 6 of 10, rank 6 (tied) | 2 of 10, rank 14 |
| Price read 2026-11-04 | no public fee schedule found on homepage or docs index (checked 2026-11-04) | IsAgent free up to 10,000 calls/month (contact Stytch above that); Device Fingerprinting USD 0.005 per fingerprint beyond 10,000 included; free tier 10,000 MAUs and AI agents. |
Verdicts by reader
- Platform engineer
- IsAgent is a client hint for analytics and agent-friendly flows; Skyfire tokens are checked server side or in a Worker.
- Security engineer
- Only Skyfire gives you a verifiable credential; IsAgent can be altered in the browser, per Stytch.
- Publisher operations
- Skyfire carries payment intent; IsAgent carries none.
What each does not do
Skyfire
- Does not detect or block unsigned bots; it only issues and settles tokens that sites or bot managers must check (docs).
- KYA tokens alone cannot be charged; only pay and kya-pay tokens move money (introduction docs).
- No published fee schedule (homepage and docs read 2026-11-04).
Stytch IsAgent
- IsAgent is not a security control; its client-side result can be tampered with (Stytch changelog, 2025-08-01).
- Detection is heuristic and not 100% accurate (IsAgent FAQ).
- No crawler monetization or per-purpose crawler policy (pages read 2026-11-04).
More: alternatives to Skyfire, alternatives to Stytch IsAgent.
Sources
Last reviewed 2026-11-04