Table of Contents
A Skyfire KYAPay token is a signed JWT that packages agent identity and a USDC-backed payment commit so a seller can verify who is calling and charge after delivery.
As of September 2026 Skyfire docs, buyers create kya (identity only), pay (payment authorization), or kya-pay (combined) via POST https://api.skyfire.xyz/api/v1/tokens with header skyfire-api-key; the docs example commits "0.005" USD units.
This guide shows how to fund a Skyfire buyer wallet with USDC on Base, mint a kya-pay token for an onboarded seller, and settle after Present → Verify → Deliver → Charge Token.
For agent wallet bootstrap first, see how to set up an AI agent wallet. For USDC funding patterns outside Skyfire, see how to fund an AI agent wallet with USDC.
Key Takeaways
- POST /api/v1/tokens with skyfire-api-key to mint kya, pay, or kya-pay JWTs.
- Onboarded sellers use sellerServiceId; default expiry is 24 hours (10s to 24h).
- External sellers need sellerDomainOrUrl, enterprise buyers, and kya only (5 minute default).
- tokenAmount must be >0, ≤ wallet balance, and ≥ seller minimum; docs example is "0.005".
- Fund via card (instant), USDC on Base (near-instant), or ACH/wire (1–3 days, paid plan).
What a Skyfire KYAPay token actually is
KYAPay is the open protocol Skyfire uses for identity-linked payment credentials purpose-built for autonomous agents. Tokens are JWTs exchanged buyer↔seller; Skyfire is not in the middle of that hop.
KYA means Know Your Agent: a kya token carries verified owner identity fields and cannot move funds. A pay token carries the committed amount sellers charge after delivery. A kya-pay token combines both for guest-style agent checkout.
Named flow in Skyfire docs: Present the token → Verify signature and claims → Deliver the service → Settle via Charge Token (buyer wallet → seller wallet). Live Directory sellers called out in docs include Dappier, BuildShip, and Apify.
Who this is for (and who should skip it)
Use Skyfire KYAPay when your buyer agent must prove identity and pre-commit USDC-equivalent spend to an onboarded seller service without wiring a custom escrow.
Skip it when you only need raw USDC sends, Circle Agent Nanopayments on x402, or sell-side accept without Skyfire Directory onboarding. Those jobs map to how to make a Circle Agent Nanopayment in USDC or how to accept x402 USDC payments from AI agents.
Named downside: external sellerDomainOrUrl tokens are enterprise-only and kya-only (no pay / kya-pay). Standard buyer agents cannot mint payment tokens for non-onboarded domains.
Create checklist (2026)
1. Sign up and grab the buyer API key
Create an account at app.skyfire.xyz. Signup provisions a Buyer Agent plus a pre-funded wallet; use the Playground to mint a first token before you wire production.
Prod API is https://api.skyfire.xyz; sandbox is api-sandbox / app-sandbox. Cache JWKS from https://app.skyfire.xyz/.well-known/jwks.json for about 60 minutes when you verify inbound tokens.
2. Fund the buyer wallet (USDC on Base preferred)
Wallet funds back pay and kya-pay creation. Skyfire funding options as of September 2026: card (instant), USDC on Base (near-instant, near-zero cost, appears as USD), ACH/wire (paid subscription, 1–3 business days).
Click Fund Wallet next to the USD balance in the dashboard, choose USDC on Base for agent micropayments, then confirm the balance covers your planned tokenAmount. Parallel playbook: how to fund an AI agent wallet with USDC.
3. Pick onboarded vs external seller
Onboarded sellers: pass sellerServiceId from the Skyfire Directory. Supports kya / pay / kya-pay. Default expiry 24 hours; expiresAt must land between 10 seconds and 24 hours.
External sellers: pass sellerDomainOrUrl. Enterprise buyers only. kya only. Default expiry 5 minutes. Do not plan pay commits against external domains on a standard key.
4. POST Create Token
Call POST https://api.skyfire.xyz/api/v1/tokens with header skyfire-api-key and JSON body fields: type, buyerTag, tokenAmount (required for pay / kya-pay), sellerServiceId or sellerDomainOrUrl, optional expiresAt, optional identityPermissions for kya / kya-pay.
Docs example for an onboarded seller: type "kya-pay", tokenAmount "0.005", plus sellerServiceId and expiresAt. Amount rules: greater than 0, less than or equal to wallet balance, greater than or equal to seller minimum. Failures return validation or payment-required errors.
5. Present, verify, deliver, charge
Hand the JWT to the seller. The seller verifies signature and claims (reject if already expired), delivers the tool or resource, then charges ≤ committed amount via Charge Token. Charges can split across multiple calls on the same token.
Settlement timing from Skyfire docs: tokens validated before expiry can still be charged for a 24-hour grace after expiry; after the charge window closes, full settlement lands within a 3-hour window (up to about 51 hours total). Charges settle sooner once cumulative charges on a token exceed $1.00.
Before you accept inbound agent spend, run how to verify an AI agent before accepting USDC.
Token types and seller targets (as of September 2026)
| Dimension | Onboarded seller (sellerServiceId) | External seller (sellerDomainOrUrl) |
|---|---|---|
| Who can mint | Standard Buyer Agent API key | Enterprise Organization Buyer API key only |
| Token types | kya, pay, kya-pay | kya only |
| Default expiry | 24 hours | 5 minutes |
| expiresAt bounds | 10s to 24h | 10s to 5m max lifetime |
| Payment commit | tokenAmount on pay / kya-pay (example "0.005") | No pay / kya-pay |
| Directory examples | Dappier, BuildShip, Apify (docs Directory) | Any domain/URL string |
Primary sources: KYAPay tokens, Create Token, wallet funding, payments & settlement.
How this differs from Circle Agent Nanopayments and raw x402
Skyfire commits funds at token creation and settles buyer→seller after Charge Token. Circle Agent Nanopayments deposit USDC into a Gateway balance and pay x402 services via Circle CLI with gasless floors down to $0.000001.
Raw x402 accept on the sell side verifies payment payloads without Skyfire JWTs. If you are selling an API for agent callers, start with how to accept x402 USDC payments from AI agents. If you want Circle's Gateway path, use how to make a Circle Agent Nanopayment in USDC.
Operational pitfalls
Assuming external domains take pay tokens. External sellerDomainOrUrl is kya-only and enterprise-gated. Standard keys fail here.
tokenAmount above balance or below seller minimum. Creation fails. Match wallet balance and Directory minimums before POST.
Accepting an already-expired JWT. Sellers must reject expired tokens at verify time. The 24h grace only covers charges for tokens validated before expiry.
Ignoring the $1.00 early-settle threshold. Cumulative charges above $1.00 settle inside the 3-hour window instead of waiting out the full grace.
Skipping seller-side KYA checks. A signed pay token is not proof the agent was allowed to spend for that principal. Use how to verify an AI agent before accepting USDC.
Related playbooks
Agent wallet bootstrap: how to set up an AI agent wallet.
Fund USDC into agent wallets: how to fund an AI agent wallet with USDC.
Sell-side x402 accept: how to accept x402 USDC payments from AI agents.
Circle nanopayment path: how to make a Circle Agent Nanopayment in USDC.
Verify before accept: how to verify an AI agent before accepting USDC.
FAQ
How do I create a Skyfire KYAPay token for USDC?
Fund the buyer wallet, then POST https://api.skyfire.xyz/api/v1/tokens with skyfire-api-key, type kya-pay, tokenAmount, and sellerServiceId for an onboarded seller.
What is the difference between kya, pay, and kya-pay?
kya is identity only and cannot charge. pay is payment authorization. kya-pay combines identity and payment in one JWT for guest-style agent checkout.
When should I use sellerServiceId vs sellerDomainOrUrl?
Use sellerServiceId for Directory onboarded sellers (kya/pay/kya-pay, 24h default). Use sellerDomainOrUrl only for enterprise external kya tokens (5 minute default).
How do I fund a Skyfire agent wallet with USDC?
In the dashboard, click Fund Wallet and send USDC on Base for near-instant, near-zero-cost funding that appears as USD. Card is instant; ACH/wire takes 1–3 business days on a paid plan.
Why did my Create Token call fail with insufficient balance?
tokenAmount must be greater than 0, less than or equal to wallet balance, and greater than or equal to the seller minimum. Top up or lower the commit and retry.
Should I use Skyfire KYAPay or Circle Agent Nanopayments?
Use Skyfire when you need KYA identity JWTs plus committed settlement to Directory sellers. Use Circle Agent Nanopayments when you want Gateway USDC balance and x402 CLI pays.
What happens after a Skyfire token expires?
Sellers must not accept already-expired tokens. If validated before expiry, charges can continue for 24 hours of grace, then settlement completes within about 3 hours (up to ~51 hours total).
Next step
Open the Skyfire Playground, fund with a small USDC-on-Base top-up, mint one kya-pay token at tokenAmount "0.005" against a Directory sellerServiceId, then charge and confirm buyer→seller settlement before you automate production agents.
This content is provided for informational and educational purposes only and does not constitute financial, investment, legal, or tax advice; no material herein should be interpreted as a recommendation, endorsement, or solicitation to buy or sell any financial instrument, and readers should conduct their own independent research or consult a qualified professional.
){kind=link}