KYAPay, from Skyfire, defines a signed JWT that carries verified agent and human identity (KYA) together with payment credentials (PAY), so a merchant can tell a human-authorized agent from a malicious bot. It is a family of individual drafts aimed at the IETF OAuth working group.
KYAPay
KYAPay, from Skyfire, defines a signed JWT that carries verified agent and human identity (KYA) together with payment credentials (PAY), so a merchant can tell a human-authorized agent from a malicious bot. It is a family of individual drafts aimed at the IETF OAuth working group.
Where it stands
As of 2026-10-13, the Agentic Standards Map records:
Individual Internet-Drafts named for the OAuth Working Group (WG) (draft-skyfire-oauth-*); WG stream or adoption: not found on the datatracker, 2026-10-13 (the pages of kyapay-token and using-kyapay-tokens show “(No stream defined)”). On 2026-10-02 the author announced new revisions of five drafts: kyapay-token-02, using-kyapay-tokens-01, amr-values-02, id-verification-02 and aml-methods-01 (datatracker date 2026-10-01 for all five). …
Why it matters to agents
KYAPay defines a signed JWT carrying verified agent and human identity (KYA) and payment credentials (PAY), so that merchant security infrastructure can distinguish human-authorised agents from malicious bots. The author’s announcement of 2026-10-02 describes the token as a “JWT token providing claims about the person or organization authorizing an agent to act, the agent platform, the agent instance, and optionally a payment method”. On the oauth list the token is discussed among bot managers, CDNs and site policy engines.
Sources
- https://mailarchive.ietf.org/arch/msg/oauth/h_YQPuYbBQf0TaiNIJQDNcxgGfc
- https://mailarchive.ietf.org/arch/msg/oauth/xFAGS_R8IsdZAQygs8J0DT5DgN0
- https://mailarchive.ietf.org/arch/msg/oauth/CbHD0qu_C-7AgMj3OdM7QNmbRjk
- https://datatracker.ietf.org/doc/draft-skyfire-oauth-kyapay-token/
- https://datatracker.ietf.org/doc/draft-skyfire-oauth-using-kyapay-tokens/
- https://www.ietf.org/archive/id/draft-skyfire-oauth-kyapay-token-02.txt
Status and relevance quoted, shortened, from the Agentic Standards Map by Francesco Marinoni Moretto, CC BY 4.0, https://frmoretto.github.io/agentic-standards-map/. The full entry, with every dated source, is in map.json under kyapay.
Industry: payments
Related standards
Standards this one builds on, supersedes, profiles or is commonly deployed beside.
