# KYAPay Token KYAPay

[7 · Pay](/category/pay/)

| KYAPay Token |
| --- |
| Category | [Pay](/category/pay/) |
| Governed by | Individual Internet-Draft, not adopted by an IETF working group; authors Ankit Agarwal (Skyfire Systems) and Michael B. Jones (Self-Issued Consulting); header area Web Authorization Protocol (OAuth) |
| Status | Active Internet-Draft, individual submission, intended status Standards Track; -02 dated 2026-10-02, expires 2027-04-05; replaces draft-skyfire-kyapayprofile |
| Phase | draft |
| Implementation | shipping |
| Adoption | unmeasured |
| Version | draft-skyfire-oauth-kyapay-token-02 (2026-10-02) |
| Specification | [https://datatracker.ietf.org/doc/draft-skyfire-oauth-kyapay-token/](https://datatracker.ietf.org/doc/draft-skyfire-oauth-kyapay-token/) |
| Found at | tokens are presented to the resource server; verifiers fetch the issuer's signing keys (Skyfire publishes its own at app.skyfire.xyz/.well-known/jwks.json) |
| Acronym collisions | KYA-OS (DIF identity layer for MCP, tracked as kya-os, unrelated) |
| Last checked | 2026-10-20 |
| Freshness | current · checked 2026-10-20 |
| Solves | Accept payments from agents, Prove an agent's identity, Let agents buy on behalf of a person |

KYAPay Token is an agentic-web standard (document format) at step 7, Pay, governed by Individual Internet-Draft, not adopted by an IETF working group; its own status is "Active Internet-Draft, individual submission, intended status Standards Track; -02 dated 2026-10-02, expires 2027-04-05; replaces draft-skyfire-kyapayprofile" (draft). It answers: How can an authorization or resource server from one vendor check which agent is calling and accept its payment token, when the token was issued by another vendor? Adoption is unmeasured, last verified 2026-10-20.

[Pay](/category/pay/) KYAPay Token defines JWT profiles that let an agent show who it is and pay in one step [[2]](#ref-2). There are three token types: kya+jwt for agent identity, pay+jwt for payment and kya-pay+jwt for both together [[2]](#ref-2). The aim is for authorization and resource servers from different vendors to verify the agent and accept its payment without a bilateral integration. The draft lists settlement types, including card schemes such as visa_vic and mastercard_scof [[2]](#ref-2).

## Overview
It is an individual Internet-Draft from Skyfire, co-authored by Michael B. Jones, and has not been adopted by an IETF working group [[1]](#ref-1). Revision -02 is dated 2026-10-02 and replaces the earlier draft-skyfire-kyapayprofile [[1]](#ref-1)[[2]](#ref-2). Skyfire publishes live signing keys for its tokens [[3]](#ref-3). It lives under Pay because of the combined token and settlement types, but it does Identify work too.

## Discovery and probe

tokens are presented to the resource server; verifiers fetch the issuer's signing keys (Skyfire publishes its own at app.skyfire.xyz/.well-known/jwks.json)

```
GET none — tokens are presented per request by the agent
parse:     No artefact at a fixed path on the resource server; a verifier would check the token's typ (kya+jwt, pay+jwt or kya-pay+jwt) against the issuer's JWKS.
on absent: Not probeable from a resource server's origin.
```

Not probed live: needs-credentials. KYAPay tokens are presented per request by the agent; nothing is published at a fixed path on the resource server.

## History
- 2026-10-20 — added from gap scout 2026-10-20; verified against the datatracker record and -02 text of draft-skyfire-oauth-kyapay-token, and Skyfire's live JWKS

## Instances

No instances recorded yet.

## See also

- Not to be confused with: KYA-OS (DIF identity layer for MCP, tracked as kya-os, unrelated)

## References

- Datatracker lists draft-skyfire-oauth-kyapay-token-02, 'KYAPay Token', as an Active individual Internet-Draft by Ankit Agarwal (Skyfire Systems Inc.) and Michael B. Jones (Self-Issued Consulting), intended Standards Track, last updated 2026-10-01, replacing draft-skyfire-kyapayprofile. — [https://datatracker.ietf.org/doc/draft-skyfire-oauth-kyapay-token/](https://datatracker.ietf.org/doc/draft-skyfire-oauth-kyapay-token/) (2026-10-01) VERIFIED
- The -02 text, dated 2 October 2026 and expiring 5 April 2027, defines the kya+jwt, pay+jwt and kya-pay+jwt token types and settlement types including visa_vic and mastercard_scof. — [https://datatracker.ietf.org/doc/html/draft-skyfire-oauth-kyapay-token-02](https://datatracker.ietf.org/doc/html/draft-skyfire-oauth-kyapay-token-02) (2026-10-02) VERIFIED
- Skyfire's JWKS endpoint returns live signing keys (HTTP 200). — [https://app.skyfire.xyz/.well-known/jwks.json](https://app.skyfire.xyz/.well-known/jwks.json) (2026-10-20) VERIFIED

[JSON](/data/protocols/kyapay-token.json) · [Markdown](/protocols/kyapay-token/index.md)