KYAPay (Skyfire)

Industryspecificationcore entry

Verified 2026-10-14. Status as of 2026-10-13. All entries.

Seams: S3

Status

Individual Internet-Drafts named for the OAuth Working Group (WG) (draft-skyfire-oauth-*); WG stream or adoption: not found on the datatracker, 2026-10-13 (the pages of kyapay-token and using-kyapay-tokens show "(No stream defined)"). On 2026-10-02 the author announced new revisions of five drafts: kyapay-token-02, using-kyapay-tokens-01, amr-values-02, id-verification-02 and aml-methods-01 (datatracker date 2026-10-01 for all five). The datatracker lists two more documents of the family, kyapay-token-exchange-01 (2026-07-19) and kyapayprofile-02 (2026-06-20, replaced by kyapay-token), seven in all. The Technical Plenary and Advisory Committee (TPAC) breakout proposal #39 (KYAPay: Verified Agent Identity and Payments for Ubiquitous Agentic Commerce) is open on 2026-10-13 with one comment and no assigned slot; the datatracker shows no revision of kyapay-token-exchange after -01 of 2026-07-19.

Relevance

KYAPay defines a signed JWT carrying verified agent and human identity (KYA) and payment credentials (PAY), so that merchant security infrastructure can distinguish human-authorised agents from malicious bots. The author's announcement of 2026-10-02 describes the token as a "JWT token providing claims about the person or organization authorizing an agent to act, the agent platform, the agent instance, and optionally a payment method". On the oauth list the token is discussed among bot managers, CDNs and site policy engines.

Committed next

• The author invites review of the updated drafts on the oauth list and at IETF 127 (14 to 20 November 2026). (undated) [participant or third party] https://mailarchive.ietf.org/arch/msg/oauth/h_YQPuYbBQf0TaiNIJQDNcxgGfc/
• Rework of the delegation text of the token-exchange draft, stated by the author on 2026-09-18. (undated) [participant or third party] https://mailarchive.ietf.org/arch/msg/oauth/CbHD0qu_C-7AgMj3OdM7QNmbRjk

Boundary

A participant review of 2026-09-23 reads hid, aid and apd as identifying principal, agent and platform, not the authority delegated.

Sources

• https://mailarchive.ietf.org/arch/msg/oauth/h_YQPuYbBQf0TaiNIJQDNcxgGfc participant or third party, read 2026-10-03 · archived
• https://mailarchive.ietf.org/arch/msg/oauth/xFAGS_R8IsdZAQygs8J0DT5DgN0 participant or third party, read 2026-10-03 · archived
• https://mailarchive.ietf.org/arch/msg/oauth/CbHD0qu_C-7AgMj3OdM7QNmbRjk participant or third party, read 2026-10-03 · archived
• https://datatracker.ietf.org/doc/draft-skyfire-oauth-kyapay-token/ official decision or commitment, read 2026-10-13
• https://datatracker.ietf.org/doc/draft-skyfire-oauth-using-kyapay-tokens/ official decision or commitment, read 2026-10-13
• https://www.ietf.org/archive/id/draft-skyfire-oauth-kyapay-token-02.txt participant or third party, read 2026-10-14

Overlaps

W3C Agentic Web Working Group (draft charter), IETF Web Bot Auth (webbotauth WG), Mastercard Agent Pay

Neighbours in the map

Solid lines: overlaps declared by one of the two entries. Dashed lines, coloured by seam: entries named by the same seam (S1 to S4) in the seams note. Every node is a link.

Evidence and coverage

Read

Datatracker search for draft-skyfire and the pages of kyapay-token and using-kyapay-tokens, 2026-10-13 (seven documents: kyapay-token-02, using-kyapay-tokens-01, amr-values-02, id-verification-02, aml-methods-01, kyapay-token-exchange-01, kyapayprofile-02); datatracker listing of 2026-10-02 (it named four, kyapay-token-02, token-exchange-01, using-kyapay-tokens-01, kyapayprofile-02); the announcement of 2026-10-02 on the oauth list names five; oauth list from 2026-08-01, subject filter (142 of 505 messages), KYAPay threads read.

Not read

The pages of the other five drafts on the datatracker (stream and state), skyfire-xyz repositories; IETF 126 session; kyapay.org beyond main page; adopters named in the announcement; threads excluded by the subject filter.

Not found

Not found in the messages read, 2026-10-03: the merchant's own identity, product identity, prices, checkout.

Open proposals