Enforce KYA-based access control

If your site or API is served through a provider like AWS or Cloudflare, you can require a valid kya or kya-pay token on incoming requests at the edge, allowing verified, user-authorized agents through while blocking anonymous traffic, and optionally charging for access. This works with your existing stack, without rebuilding your application.

Looking to publish a new, discoverable service instead? This guide is for gating an existing site or API at the infrastructure level. To register a service in the Skyfire directory so agents can find and pay for it, see the Seller Guide and Integrating Tokens into Your Skyfire Services.

Why enforce access control

• Block anonymous scraping. Require identity before serving content, so automated traffic can't consume your site or API anonymously.
• Allow the agents you want. Verified, user-authorized agents present a kya token and get through, instead of being caught by blanket bot blocking.
• Attach a real identity to traffic. Every allowed request carries a verified identity you can inspect and log.
• Monetize access. Require a kya-pay token to charge agents for the content or API calls they consume.

How it works

1. The agent includes a Skyfire token in the kyapay-token header of its request.
2. Your edge, gateway, or server verifies the token: it checks the signature against Skyfire's JWKS and validates the claims. See Verify and Extract Data from Tokens.
3. Requests with a valid token are served. Requests with a missing or invalid token are blocked with a clear error that tells the caller how to get a token. See Handling Missing or Invalid Tokens.

Decide what to enforce

Each integration guide lets you choose along two axes:

Integration guides

Add KYA token enforcement to a site or API you already serve through these providers:

Using a provider that isn't listed yet? The same pattern applies anywhere you can inspect a request header and verify a token. Reach out at [email protected] and we can help you integrate.

Related

• Verify and Extract Data from Tokens
• Handling Missing or Invalid Tokens
• Security Brief for Sellers and Bot Managers