Enforce KYA-based access control
Add KYA token enforcement to a website or API you already operate, gating agent access at the edge without rebuilding your service.
Add Skyfire token enforcement to a website or API you already operate. If your site or API is served through a provider like Cloudflare, you can require a valid kya or kya-pay token on incoming requests at the edge, allowing verified, user-authorized agents through while blocking anonymous traffic, and optionally charging for access. This works with your existing stack, without rebuilding your application.
Looking to publish a new, discoverable service instead? This guide is for gating an existing site or API at the infrastructure level. To register a service in the Skyfire directory so agents can find and pay for it, see the Seller Guide and Integrating Tokens into Your Skyfire Services.
Why enforce access control
- Block anonymous scraping. Require identity before serving content, so automated traffic can't consume your site or API anonymously.
- Allow the agents you want. Verified, user-authorized agents present a
kyatoken and get through, instead of being caught by blanket bot blocking. - Attach a real identity to traffic. Every allowed request carries a verified identity you can inspect and log.
- Monetize access. Require a
kya-paytoken to charge agents for the content or API calls they consume.
How it works
- The agent includes a Skyfire token in the
kyapay-tokenheader of its request. - Your edge, gateway, or server validates the token: it verifies the signature against Skyfire's JWKS and checks the claims. See Verify and Extract Data from Tokens.
- Requests with a valid token are served. Requests with a missing or invalid token are blocked with a clear error that tells the caller how to get a token. See Handling Missing or Invalid Tokens.
Decide what to enforce
Each integration guide lets you choose along two axes:
Require a kya token to enforce identity only, or a kya-pay token to also charge for access.
Gate automated requests only, letting human traffic through, or require a valid token from every request.
Integration guides
Add KYA token enforcement to a site or API you already serve through these providers:
Using a provider that isn't listed yet? The same pattern applies anywhere you can inspect a request header and run token validation. Reach out at [email protected] and we can help you integrate.
Related
- Verify and Extract Data from Tokens
- Handling Missing or Invalid Tokens
- Security Brief for Sellers and Bot Managers
Updated 1 day ago