KYA

The term comes from a published protocol whitepaper, which states that identity verification involves both traditional know-your-customer and know-your-business processes and the validation of agent identity, referred to together as Know Your Agent. It separates the user identity — the end-user or organization behind the agent, held for billing, compliance and fraud prevention — from the agent identity, the unique identity of the agent acting on the user's behalf, together with its credentials or delegated permissions.

The term is a vendor's before it is the sector's, and the entry says so rather than implying a standard. KYAPay is published by Skyfire; what is quoted above is that document's own account of the idea, and no body has standardised the phrase. That implementation defines token types carrying identity, payment authorization, or both.

Why it earns a name at all is that the two questions come apart. A payment authorization proves somebody signed for an amount; it says nothing about which agent presented it or on whose instruction. The identity work elsewhere in this sector — signed requests under RFC 9421, recognition protocols — answers who is asking without answering who authorised the spend.

For anything reading endpoints from outside, none of it is visible. An endpoint sees a request and whatever that request chose to carry, so what a reading shows is the terms offered to whoever asked, which is the same evidence either way.