Resource Provider

You are a resource provider if your organization users offer resources, such as APIs, MCP servers, or webpages. In most organizations, each organization user represents one of your customers. This page describes each setup step and the API call behind it. For what an organization is and how onboarding works, see the Organization Guide.

Before you start: This page is written for your organization's administrators. It assumes Skyfire has onboarded your organization and that you have your organization ID and an administrator user API key. Skyfire issues the first one to your designated administrator. All endpoints below are relative to your environment's base URL (see Environments). Every call authenticates with the skyfire-api-key header (see API Authentication).

0. How organization users map to your customers

The structure of your organization users generally follows the structure of your existing customer base. An organization user typically represents one of the following:

• A customer individual. One organization user per person, with their own identity. For example, a handmade goods marketplace gives each independent maker an organization user whose seller agents sell the maker's products to buyer agents (B2C). The marketplace (or Skyfire) runs KYC (Know Your Customer) on each maker, which confirms that the maker is a real, identifiable person.
• A customer organization. One organization user per customer organization, with a shared identity. For example, an ecommerce platform gives each store one organization user, shared across the business, whose seller agents sell the store's catalog to buyer agents (B2B). The platform (or Skyfire) runs KYB (Know Your Business) on each store, which confirms that the store is a legitimate, registered business.

1. Create organization users

Organization users are created with an administrator user API key. Each organization user has one of two roles:

Your designated administrator can create additional administrators, so that more than one person on your team can manage organization users. Each new administrator receives their own administrator user API key. Any administrator can create organization users.

Creating an organization user also provisions a buyer agent and its agent API key. Resource providers don't use either, so you can ignore them. Save the userId from the response instead. The next step uses it to create the organization user's seller agent.

{
  "email": "[email protected]",
  "role": "MEMBER"
}

{
  "userId": "f694008b-c3ca-4122-9f27-e1b18c19f677",
  "buyerAgent": {
    "id": "29d0562b-4e78-4428-85f3-38da8fad6be5",
    "apiKey": "82b033a0-00cc-4884-9269-004db880c2bf"
  }
}

To list organization users see Get Organization Users​.

2. Create seller agents for each organization user

For each organization user, use their user ID to create a seller agent for them. The seller agent owns their seller services and holds any USDC their revenue settles into.

{ "displayName": "Acme Widgets" }

{
  "id": "c649dc85-eafc-49c6-8e43-3a5161dce5c0",
  "apiKey": "af8b3bc1-19fa-40e1-8853-b0ef627d71a9"
}

3. Verify and set organization user PII

Buyers decide whether to trust a seller before they pay or share data with it. When an organization user is verified, its seller agent sends buyers trusted signals that a confirmed party offers the resource. The personally identifiable information (PII) you verify and set for each organization user is the basis for those signals. Verified identity also supports secure transactions and access control, and it's required for Skyfire's Verified Service Guarantee.

Verify identity

Verification confirms that each organization user is who they claim to be. Customer individuals complete KYC (Know Your Customer). Customer organizations complete KYB (Know Your Business). Verify each organization user before you set their PII.

You choose who runs verification:

• Skyfire. Skyfire runs verification and is named as the verifier in the resulting token claims.
• Your organization (optional). You build and run your own verification process, which must meet Skyfire's criteria. Your organization is named as the verifier instead.

Reach out to your Skyfire contact to set up verification.

Once verification completes, every agent the organization user holds inherits its verification status. For how verification works across Skyfire, see Know Your Agent (KYA).

Set PII

Once an organization user is verified, set the PII that verification confirmed. Skyfire stores it securely.

Set your designated administrator's PII first, because Skyfire uses it to fill the apd claim in every identity token your organization users create.

  {
    "data": {
      "person": { "firstName": "Ada", "lastName": "Lovelace", "birthdate": "1990-12-10" },
      "phoneNumbers": [
        { "type": "Mobile", "countryCode": "1", "areaCode": "415", "number": "5550142" }
      ],
      "addresses": [
        { "type": "Home", "street1": "1 Analytical Way", "city": "San Francisco", "state": "CA", "zip": "94105", "countryCode": "US" }
      ]
    }
  }

See the full PII attribute catalog at Identity Fields.

4. Facilitate seller service creation

A seller service is a resource published on the Skyfire directory that explicitly accepts a KYAPay token in exchange for access. Buyer agents find the listing in the directory and create tokens for it, and its ID travels in every token as the ssi claim. See How Seller Services Work for what a seller service costs and requires, and how approval works.

Each resource an organization user offers, such as an API, an MCP server, or a webpage, needs its own seller service, created with that user's seller agent API key. Your organization users can manage their seller agents and services directly in the Skyfire Dashboard or API, using Skyfire-issued credentials. Optionally, they call your own service instead, which proxies their calls to Skyfire; you build and run that proxy, and you control the underlying Skyfire-issued credentials.

{
  "name": "Acme Widgets",
  "description": "MCP server selling widgets to agents",
  "tags": ["mcp", "widgets"],
  "type": "MCP_SERVER_REMOTE",
  "mcpServerUrl": "https://mcp.acme.example/mcp",
  "price": "0.05",
  "priceModel": "PAY_PER_USE",
  "minimumTokenAmount": "0.05",
  "acceptedTokens": ["kya", "pay", "kya-pay"],
  "maxTokenTTLSeconds": 3600,
  "humanIdentityRequirement": { "organization": [], "individual": [] }
}

A new seller service needs Skyfire's approval before buyer agents can create tokens for it. Editing a seller service resets it to unapproved and inactive, so after Skyfire re-approves it, activate it again.

Once approved and active, the service is discoverable in the Skyfire Directory.

5. Verify and charge tokens

Each seller service verifies every token it receives, delivers what the buyer agent asked for, and charges pay and kya-pay tokens. Your organization users can run this flow in their own services, or you can run it for them in yours. Both paths make the calls below with the organization user's seller agent API key. See Verify, deliver, and charge in How Seller Services Work for the flow and the full verification checklist.

{ "isValid": true, "expiresAt": 1795000000, "chargeableUntil": 1795086400, "remainingBalance": "0.05" }

A token's value, in the val claim, is in micro-USD: $1 is 1000000. Skyfire prevents a token from being charged twice, but a kya token can be reused until it expires, so track each jti if you need to stop reuse within a session.

{ "token": "eyJ...", "chargeAmount": "0.05" }

{ "amountCharged": "0.05", "remainingBalance": "0.00" }

Whoever delivers the resource should charge before delivering anything that can't be taken back. For long-running or metered work, charge in small increments as each unit is delivered, rather than one large charge up front.

7. Reconcile payments

Charges accumulate as claims to each seller agent's wallet, and settle through redemption. See Settlement of Payments. Organization users can see their balances and history in the Skyfire Dashboard. To reconcile across your organization, poll the endpoints below. Each call uses the organization user's seller agent API key.

Next steps

• To let your organization users acquire resources as well, see Agent provider. A marketplace organization follows both guides.
• For how a seller service verifies and charges tokens in your own backend, see How Seller Services Work.
• For holds, charges, and settlement timing, see Payments & Settlement.
• To make your seller services discoverable to buyer agents, see Skyfire Directory.
• To offer agentic identity and wallets to organizations of your own, see Service Provider Guide.