Enforce KYA-based access control

If your website or API is served through a provider like AWS or Cloudflare, you can require a valid kya or kya-pay token on incoming requests at the edge, allowing verified, user-authorized agents through while blocking anonymous traffic, and optionally charging for access. This works with your existing stack, without rebuilding your application.

This guide is for gating an existing website or API at the infrastructure level. To register a service in the Skyfire directory so agents can find and pay for it, see the Seller Guide and Seller Services.

Why enforce access control

• Block anonymous scraping. Require identity before serving content, so automated traffic can't consume your website or API anonymously.
• Allow the agents you want. Verified, user-authorized agents present a kya token and get through, instead of being caught by blanket bot blocking.
• Attach a real identity to traffic. Every allowed request carries a verified identity you can inspect and log.
• Monetize access. Require a kya-pay token to charge agents for the content or API calls they consume.

How it works

1. The agent includes a Skyfire token in the kyapay-token header of its request.
2. Your edge, gateway, or server verifies the token: it checks the signature against Skyfire's JWKS and validates the claims. See Verify and Extract Data from Tokens.
3. Requests with a valid token are served. Requests with a missing or invalid token are blocked with a clear error that tells the caller how to get a token. See Handling Missing or Invalid Tokens.

Decide what to enforce

Each integration guide lets you choose along two axes:

Integration guides

Add KYA token enforcement to a website or API you already serve through these providers:

Using a provider that isn't listed yet? The same pattern applies anywhere you can inspect a request header and verify a token. Reach out at [email protected] and we can help you integrate.

Related

• Verify and Extract Data from Tokens
• Handling Missing or Invalid Tokens
• Security Brief for Sellers and Bot Managers