The history of internet commerce is a history of trust infrastructure. SSL certificates let browsers trust websites. PCI-DSS gave merchants confidence to accept cards online. OAuth let apps access your data without storing your password. Each wave of commerce needed a new layer of trust before it could scale.
AI commerce is no different, and KYAPay is its trust layer - the infrastructure that makes agentic payments safe to scale.
The problem KYAPay solves
AI agents can already browse the web, call APIs, and make decisions. They can now even pay for things, but the infrastructure to do that reliably and at scale is still in its early days, and most agents still have no standard way to prove they should be trusted to transact.
Today, when an AI agent attempts to purchase something on a user’s behalf, businesses face a dilemma: treat it like a bot and block it, or treat it like a human and absorb the compliance and fraud risk. Neither is optimal. Agents are neither bots to be managed nor humans to be onboarded through a standard KYC flow.
KYAPay, launched by Skyfire in late June 2025, is designed specifically for this gap. Where traditional finance runs on KYC (Know Your Customer), agentic finance needs KYA (Know Your Agent).
How KYAPay works
KYAPay is an open protocol that bundles two things agents have historically lacked: verifiable identity and programmable payment authority.
The protocol uses signed JSON Web Tokens (JWTs) to carry both pieces of information in a form that any service can verify independently. The two main token types are KYA Identity and Programmable Payment.
- KYA Identity Token is a signed JWT that establishes who the agent is and who owns it. This isn't the agent identifying itself; it's a verifiable attestation that links the agent to a real, accountable human principal. When a merchant or API receives this token, they can confirm the agent is acting on behalf of a real, authorized user - not operating rogue.
- Programmable Payment Token is a signed JWT authorizing a specific spend amount, denominated in USDC or a tokenized credit/debit card. This token can be captured and settled by the receiving service without any further human action in the loop. Agents and enterprises can also fund wallets via credit/debit cards or ACH, which gives the payment rails broader flexibility than the tokens alone might suggest.
Together, these tokens allow a complete transaction - authentication, account creation, and payment - to happen autonomously, without a human manually handing over credentials at each step.
How KYAPay fits into existing infrastructure
One of the protocol's strengths is that it doesn't require businesses to rebuild their authentication systems. KYAPay is designed to be complementary to OAuth2 and OIDC, the standards that already govern most web authentication. Account creation via KYAPay involves exchanging a KYA token for an access token - a pattern developers already understand.
This means the path to integration is measured in hours, not sprints. Skyfire offers SDKs for Node, Python, and Go, and developers can onboard in as little as 15 minutes for basic integrations.
The MCP connection
KYAPay has particular relevance for the Model Context Protocol (MCP) ecosystem. MCP gives AI agents the ability to discover and call tools across services. But tool access often requires payment, and there’s been no standard way for an agent to pay for MCP server usage without human intervention.
KYAPay solves that problem by serving as a monetization layer for MCP servers. Apify's integration is a solid example: agents can connect to both the Skyfire MCP server and the Apify MCP Server to autonomously discover, pay for, and run web automation tools without creating a traditional account or API token. The agent generates a payment token via Skyfire, presents it to the Apify MCP Server, and executes the tool in a single autonomous sequence.
Human controls in an autonomous flow
Agentic commerce doesn’t mean humans are taken out of the picture. KYAPay includes mechanisms for human oversight at the right moments.
Skyfire's Agent Checkout includes controls that let users configure spending thresholds for their AI agents. When an agent hits a transaction above that size, it can pause and prompt the human for approval. It sends an SMS, waits for confirmation, then continues its work. Routine transactions below the threshold proceed autonomously, including microtransactions below $5 that the platform's KYAPay protocol is designed to handle. This design reflects a broader principle: the goal is not to remove human judgment, but to avoid requiring human presence for every routine transaction.
The accountability layer
Perhaps the most important long-term implication of KYAPay is regulatory and legal rather than technical. When an autonomous agent commits a financial error - or worse, fraud - the critical question is: who’s accountable?
By creating an auditable, cryptographically verifiable chain from agent action to human principal, KYAPay provides an answer. Every transaction carries proof of who authorized the agent and what they were authorized to spend. That auditability is what will ultimately allow regulators and enterprises to get comfortable with autonomous commerce at scale.
Status and ecosystem
In December 2025, Skyfire demonstrated an end-to-end agentic purchase using KYAPay integrated with Visa's Intelligent Commerce suite - an AI agent researching headphones using Consumer Reports, then selecting and completing a purchase on Bose.com without human intervention at the point of transaction.
It’s still early days, the ecosystem is still taking shape, and competing protocols exist - including x402 from Coinbase, Google's A2P, and OpenAI's ACP. But it’s pretty clear that the infrastructure for agents to participate in commerce as first-class economic actors is already being built, and KYAPay is one of the most complete implementations of that vision to date.
Read Agentic commerce and the AI economy stack for broader context on how KYAPay fits alongside MCP, agent wallets, and the emerging A2A payment layer.
