Originate Tokens

An originator is an organization that uses Skyfire to offer agentic access and agentic payments to its customers, typically agent platforms. Skyfire issues the kya, pay, and kya-pay tokens and hosts the identity and wallet infrastructure behind them.

As an originator, your customers look to you to facilitate token creation for their agents. Skyfire issues tokens, and your organization's URL is set in tokens' ori claim. Agents present these tokens to merchants and services to prove their identity or complete a purchase, and the ori claim makes clear to those recipients that you are the originator. What varies is how the request reaches Skyfire: your customer can call Skyfire directly, or call a wrapper you host that creates tokens on their behalf. You choose between these in Phase 0 of onboarding.

Originating kya, pay, and kya-pay tokens requires an Enterprise Agreement with Skyfire. Reach out to [email protected] to set one up.

This guide describes the setup required to become an originator on Skyfire and originate tokens for your customers.

Skyfire enables you to

Originate tokens

Originate tokens that agents present as identity and payment credentials to websites and APIs.

Provide wallets

Give agents wallets and the ability to collect authorizations, so they can make purchases on behalf of their end users.

Roles

Several parties are involved in originating tokens and putting them to use. Here's who's responsible for what:

Role	Description
End user	The person on whose behalf an agent acts, the human principal.
Agent / Agent Platform (your customer)	Runs the agents, which act on behalf of the end user and presents tokens to merchants or services. Owns the relationship with its end users, and is responsible for KYC of its end users.
Originator (you)	Provider of agentic identity and agentic wallets to its customers. Responsible for KYB of its customers.
Skyfire	Issues the tokens and hosts the identity and wallet infrastructure behind them.
Skyfire's KYAPay Acceptance Network	A network of security vendors that merchants use to help secure their websites and APIs, including bot managers, fraud managers, account takeover protectors, and CIAMs.
Merchant / Service	Accepts tokens from agents to grant access, complete a purchase, or both.

Skyfire has partnerships with a large and growing list of security vendors that natively accept kya/kya-pay tokens. If you are a security vendor who wants to enable agentic access and payments for your merchants and services, see kyapay.org for more information and reach out to [email protected].

Onboarding

Onboarding moves through four phases, and each phase has a different party responsible for it:

#	Phase	Responsible party
0	You choose your operating model	You
1	Skyfire sets you up as an originator	Skyfire
2	You onboard your customer	You, with setup performed by Skyfire
3	Your customer onboards its agents and end users	Your customer, with setup performed by you

Phase 0: You choose your operating model

Two decisions shape the rest of your setup: your access model and your verification model. Later phases refer back to both by name.

1. Access model: how will your customers access Skyfire's APIs?

Skyfire's APIs cover provisioning users, submitting their personal data, and creating kya, pay, and kya-pay tokens. See APIs at a glance for the full list.

Your customers call Skyfire's APIs and iframes directly, using credentials Skyfire issues them.

2. Verification model: who verifies your customers and their end users?

You perform KYB on your customers. They perform KYC on their end users, using a process that meets Skyfire's criteria. Your organization is named as the verifier in the resulting token claims.

This choice determines the verifier, verified, and verification_id fields inside the apd, hid, and sti token claims.

Throughout onboarding and afterward, you are the sole point of contact for your customer. Skyfire does not engage with your customers directly; all customer-facing communication and support flows through you.

Phase 1: Skyfire sets you up as an originator

This phase does not require any action from you. Skyfire configures token claims:

Originator (ori). Tokens carry your organization's URL in the ori claim.
Verifier (verifier). Tokens carry the verifying party's URL in the verifier claim, alongside verified and verification_id. Your verification model determines which party that is.

Phase 2: You onboard your customer

Each customer must be onboarded before it can operate as an agent platform.

Your action: complete KYB. Per your verification model, either you or Skyfire performs KYB on each customer.
Skyfire's action: onboard the customer. Skyfire onboards the customer as an agent platform.
Skyfire's action: set up a designated administrator. Skyfire sets up a designated administrator, a staff member at the customer's company, and shares the resulting credentials with you. Handle those credentials per your access model. Tokens later identify this designated administrator as the contact person in the apd claim.

Phase 3: Your customer onboards its agents and end users

This phase is your customer's responsibility, performed using the designated administrator's credentials from Phase 2. Your customer makes both calls below per your access model.

Buyer agent provisioning. Your customer creates additional buyer agents by provisioning Skyfire users, and securely stores the resulting credentials.
Complete KYC. Per your verification model, either you or Skyfire completes KYC for each end user. Once KYC is complete, your customer submits the end user's PII to Skyfire.

At this point, you can originate kya, pay, and kya-pay tokens for these buyer agents.

APIs at a glance

The APIs below are the ones your customers and their agents call during and after onboarding. Your customers call them per your access model, either directly on Skyfire or through wrapper endpoints you host.

API	Purpose	Initiator	Reference documentation
Create Token	Creates `kya`, `pay`, and `kya-pay` tokens.	Agent	Create Token
Create Enterprise User	Provisions a Skyfire user, returning credentials for a buyer agent.	Agent platform's designated administrator	Create Enterprise User
Set Enterprise User Personal Data	Submits an end user's PII once KYC is complete.	Agent platform's designated administrator	Set Enterprise User Personal Data

Originating card-backed pay and kya-pay tokens is fully supported. Creating one involves Skyfire's Payments React SDK, rather than an API call on its own. See Building an Agentic Checkout for how that works.

NOTE: SDKs for other frameworks and languages are also available. Please contact us for yours.

Next steps

To see how the tokens you originate fit into an agentic purchase, see Agentic Commerce with Payment Cards.
To build an agentic checkout with Skyfire's Payments React SDK, see Building an Agentic Checkout.