KYAPay Token vs Agent Payments Protocol (AP2)
The map lists them as complementary: sites and agents commonly implement both.
| KYAPay Token KYAPay | Agent Payments Protocol AP2 | |
|---|---|---|
| Lifecycle step | 7 Pay: Settle the bill | 7 Pay: Settle the bill |
| Answers | How can an authorization or resource server from one vendor check which agent is calling and accept its payment token, when the token was issued by another vendor? | Did the user actually authorize what this agent is about to buy and pay for, and can the merchant prove it later? |
| Governed by | Individual Internet-Draft, not adopted by an IETF working group; authors Ankit Agarwal (Skyfire Systems) and Michael B. Jones (Self-Issued Consulting); header area Web Authorization Protocol (OAuth) | Google; core specification donated to the FIDO Alliance (Payments TWG and Agentic Authentication TWG), 2026-04-28; the google-agentic-commerce/AP2 repository now hosts only samples and an SDK, not the normative spec text |
| Status (issuer's words) | Active Internet-Draft, individual submission, intended status Standards Track; -02 dated 2026-10-02, expires 2027-04-05; replaces draft-skyfire-kyapayprofile | Security/authorization protocol for agent-performed payments; core spec now stewarded by FIDO Alliance |
| Version | draft-skyfire-oauth-kyapay-token-02 (2026-10-02) | v0.2.0 (2026-04-28) |
| Form / transport | document format | endpoint |
| Found at | tokens are presented to the resource server; verifiers fetch the issuer's signing keys (Skyfire publishes its own at app.skyfire.xyz/.well-known/jwks.json) | none |
| Implementation | shipping | multi-implementation — Google (launch blog post, 60+ launch partners) |
| Evidence | 3 verified | 4 verified, 2 reported |
| Primary use case | Accept payments from agents | Let agents buy on behalf of a person |
| Last verified | 2026-10-23 (current) | 2026-10-23 (current) |
| Specification | https://datatracker.ietf.org/doc/draft-skyfire-oauth-kyapay-token/ | https://raw.githubusercontent.com/google-agentic-commerce/AP2/main/docs/ap2/specification.md |
When to use which
- Choose KYAPay Token when your question is “How can an authorization or resource server from one vendor check which agent is calling and accept its payment token, when the token was issued by another vendor?” and you accept its maturity: status "Active Internet-Draft, individual submission, intended status Standards Track; -02 dated 2026-10-02, expires 2027-04-05; replaces draft-skyfire-kyapayprofile", implementation shipping.
- Choose Agent Payments Protocol when your question is “Did the user actually authorize what this agent is about to buy and pay for, and can the merchant prove it later?” and you accept its maturity: status "Security/authorization protocol for agent-performed payments; core spec now stewarded by FIDO Alliance", implementation multi-implementation (Google (launch blog post, 60+ launch partners)).
Read the full articles
- KYAPay Token: How can an authorization or resource server from one vendor check which agent is calling and accept its payment token, when the token was issued by another vendor?
- Agent Payments Protocol: Did the user actually authorize what this agent is about to buy and pay for, and can the merchant prove it later?