Vendor, ranked 6 (tied) of 15
Skyfire
In short
Skyfire is an identity and payment layer for agents: its KYA tokens grade yes on verification, charging and commerce agents, for 6 of 10 points. Per-purpose policy is not its job, and reporting is not published. Unsigned bots are outside its reach, since Skyfire only mints and settles tokens.
Identity and payments layer for AI agents: it issues signed KYA identity tokens and pay tokens that websites and bot managers verify against Skyfire's public keys, with settlement between Skyfire wallets.
Alternatives to Skyfire ยท skyfire.xyz
- Type
- Licensing intermediary
- Homepage
- skyfire.xyz
- Last read
- 2026-11-05
The rubric, with evidence
| Question | Grade | What the vendor documents |
|---|---|---|
| Tells a verified agent from a spoof | Yes | KYA JWTs that sites verify via Skyfire's JWKS; not a bot manager itself |
| Per-purpose policy (train, search, answer, act) | Not its job | sellers decide access from token claims such as agent and principal identity |
| Charging for access | Yes | pay and kya-pay tokens charged by sellers, settled between Skyfire wallets |
| Lets signed commerce agents through | Yes | KYAPay carries identity plus payment intent; card payment flow documented |
| Cost | not published (checked 2026-11-04) | |
| Reporting | Not published | on pages read (checked 2026-11-04) |
| Where it runs | either: sellers verify tokens in their backend, in a Cloudflare Worker, or through partner bot managers (F5, Akamai, Fastly) |
Cost
no public fee schedule found on homepage or docs index (checked 2026-11-04) Source, read 2026-11-04.
What Skyfire does not do
- Does not detect or block unsigned bots; it only issues and settles tokens that sites or bot managers must check (docs).
- KYA tokens alone cannot be charged; only pay and kya-pay tokens move money (introduction docs).
- No published fee schedule (homepage and docs read 2026-11-04).
- Skyfire does not sit in the request path; tokens travel straight from buyer to seller and the seller or its bot manager does the verification.
Documented facts
- Primary source Skyfire issues three token types: kya proves identity, pay authorizes a payment to a seller, and kya-pay combines both. Source, read 2026-11-04, dated 2026-07-27.
- Primary source Skyfire tokens are ES256-signed JWTs sent in a kyapay-token header; the older skyfire-pay-id header is deprecated. Source, read 2026-11-04, dated 2026-11-03.
- Primary source Sellers verify tokens against Skyfire's JWKS at app.skyfire.xyz/.well-known/jwks.json, caching keys up to 60 minutes, then check typ, env, iss, iat, exp and the hid, apd and aid claims. Source, read 2026-11-04, dated 2026-11-03.
- Primary source Creating a pay or kya-pay token commits funds from the buyer's wallet, so a seller charging a valid token is guaranteed payment up to the committed amount. Source, read 2026-11-04, dated 2026-07-13.
- Primary source Tokens expire between 10 seconds and 24 hours after creation, and a token validated before expiry can be charged for up to 24 hours after it expires. Source, read 2026-11-04, dated 2026-07-13.
- Primary source Full settlement can take up to about 51 hours, but charges settle within a 3-hour window once a token's cumulative charges pass USD 1.00. Source, read 2026-11-04, dated 2026-07-13.
- Primary source The KYA protocol lets agent developers state who they are, the platform they run on and the users they represent; KYAPay adds user intent and tokenized payment credentials. Source, read 2026-11-04.
- Primary source Skyfire's docs include a guide for enforcing KYA tokens on a site served through Cloudflare using a Worker and optional WAF rules. Source, read 2026-11-04.
- Primary source F5 and Skyfire announced on 18 Mar 2026 an integration of Skyfire's KYA protocol into F5's bot defense, letting agents complete standard checkout with tokenized payment credentials. Source, read 2026-11-04, dated 2026-03-18.
- Primary source Fastly and Skyfire partnered on 10 Jun 2026 to bring Skyfire identity and payment-backed credentials to Fastly's edge. Source, read 2026-11-04, dated 2026-06-10.
- Primary source Akamai's June 2026 agentic framework names Skyfire and Experian Know Your Agent among its integrations. Source, read 2026-11-04, dated 2026-06-15.
- Vendor claim Skyfire's homepage presents KYA as a portable verified identity token accepted by the majority of the commercial internet and shows Akamai, Fastly, Experian and Visa among partners. Source, read 2026-11-04.
Compared with
- Skyfire vs Stytch IsAgent: Skyfire issues signed KYA and pay tokens that sellers verify against its JWKS; Stytch IsAgent is a front-end flag that Stytch says must not be used as a security control.
- Skyfire vs TollBit: Skyfire is the payer side: agents carry kya-pay tokens with committed funds; TollBit is the publisher side: a paywall with publisher-set rates that AI companies access with TollBit tokens.
- Skyfire vs Cloudflare: Skyfire tokens ride in a kyapay-token header and are verified against Skyfire's JWKS; Cloudflare verifies Web Bot Auth signatures from a Signature-Agent key directory.
- Auth0 for AI Agents vs Skyfire: Auth0 issues identities and short-lived tokens to agents a company builds for its own users; Skyfire issues KYA tokens that any third-party site can verify.
What Skyfire does for this layer
From the vendor's own pages
Skyfire tells sellers to answer 401 Unauthorized when the kyapay-token header is missing, 403 Forbidden when the token is expired or fails verification, and 402 Payment Required when a pay token's balance is too low. (docs.skyfire.xyz, dated 2026-09-24) Skyfire's security brief for sellers and bot managers says Skyfire runs KYB checks on the buy-side agent platforms it onboards and verifies, directly or through those platforms, the people or businesses behind the agents. (docs.skyfire.xyz, dated 2026-11-03) Skyfire kya tokens are RFC 7515 and RFC 7519 signed JWTs whose aud, ssi, srl and sdm claims tie each token to one seller, so a copied token fails at any other site. (docs.skyfire.xyz, dated 2026-11-03) Skyfire lets a seller set the maximum expiry of tokens created for it, trading replay risk against friction for the buying agent. (docs.skyfire.xyz, dated 2026-11-03)
Know Your Agent verification at Skyfire needs a paid subscription on an Individual or Organization plan, and the verified identity then passes to every buyer and seller agent on that account. (docs.skyfire.xyz, dated 2026-07-14) Skyfire tokens disclose only the identity fields a seller requires, and token creation fails when the buyer is not verified to the level the service demands. (docs.skyfire.xyz, dated 2026-07-14) Skyfire's docs show sellers how to declare token requirements in an OpenAPI spec and in MCP server tool descriptions, and list services in a Skyfire Directory with a Verified Service Guarantee. (docs.skyfire.xyz)
Claims the vendor makes about itself
Skyfire's documentation index describes Skyfire as "the open identity and payments layer for AI agents" that lets developers monetize APIs, tools and content to agents with token-based authentication and stablecoin payments. (docs.skyfire.xyz) Skyfire's homepage claims KYA coverage of "60%" of the web through infrastructure partners and shows HUMAN Security, Akamai, DataDome, F5, Fastly, Imperva and Cequence among them. (skyfire.xyz) Skyfire's homepage lists Visa, Mastercard, Discover and USDC for its Agentic Wallet, which enrols user cards, holds stablecoins and collects user mandates for checkout. (skyfire.xyz)
Reported by a third party
Visa named Skyfire on 18 Dec 2025 among the US agent-enabling partners in Visa Intelligent Commerce pilots, enabling Consumer Reports' recommendation agent to demonstrate a purchase of Bose headphones by browser automation. (usa.visa.com, dated 2025-12-18)
Products and plans
| Product | What it does | Price model | From | As of |
|---|---|---|---|---|
| Know Your Agent (KYA) | Signed identity token binding platform, agent and human principal, verified through a paid subscription. | subscription for verification (Individual or Organization) | Not published | 2026-11-05 |
| KYAPay tokens (pay, kya-pay) | Payment-backed tokens a seller charges per request, settled between Skyfire wallets. | |||
| Agentic Wallet | Wallet that enrols user cards and stablecoins and collects user mandates for agent checkout. | |||
| Skyfire Directory | Discovery listing of seller services, tools and agents with a Verified Service Guarantee. | |||
Standards
| Standard | Status | Evidence |
|---|---|---|
| Web Bot Auth | No statement | Skyfire identifies agents with its own JWTs in the kyapay-token header; the docs index has no Web Bot Auth page (checked 2026-11-05). |
| Visa Trusted Agent Protocol | No statement | Visa names Skyfire as a Visa Intelligent Commerce pilot partner; Skyfire's docs do not describe TAP signing (checked 2026-11-05). |
| Mastercard Agent Pay | No statement | Mastercard appears in the homepage partner strip; no Agent Pay integration is documented (checked 2026-11-05). |
Our checks
| Check | Result | Method | Date |
|---|---|---|---|
| Homepage fetch | HTTP 200 | GET with the crawl user agent after a robots.txt check | 2026-11-05 |
Reading notes
Skyfire's docs disagree with themselves: the security brief updated on 3 November 2026 still gives skyfire-pay-id as the example header, while the token verification page marks that header deprecated in favour of kyapay-token. Both are recorded.
Related pages on this site
- All licensing intermediaries
- The full vendor list
- Akamai (Bot & Agent Control)
- DataDome (Bot Protect, Agentic Trust)
- Fastly (Bot Management, AI Bot Management)
- HUMAN Security (Sightline, AgenticTrust)
- Imperva, a Thales company (Advanced Bot Protection)
- Auth0 for AI Agents (Okta)
- Apify Website Content Crawler
- Alternatives to Skyfire (KYA, KYAPay, Agentic Wallet)
Sources
- skyfire.xyz: skyfire.xyz
- skyfire.xyz: skyfire.xyz
- docs.skyfire.xyz: verify and extract data from tokens.md
- docs.skyfire.xyz: payments settlement.md
- kyapay.org: kyapay.org
- docs.skyfire.xyz: llms.txt
- docs.skyfire.xyz: introduction to skyfire.md
- f5.com: f5 skyfire secure agentic commerce
- investors.fastly.com: fastly and skyfire partner enable trusted agentic commerce
- akamai.com: akamai unveils agentic security framework to power trusted ai driven interactions and commerce
- Skyfire docs: Handling Missing or Invalid Tokens
- Skyfire docs: Security Brief for Sellers and Bot Managers
- Skyfire docs: Know Your Agent (KYA)
- Visa and Partners Complete Secure AI Transactions, Setting the Stage for Mainstream Adoption in 2026
Last reviewed 2026-11-05