Skyfire and hCaptcha Bring Verified AI Agent Identity to Bot Protection

Skyfire has integrated its Know Your Agent (KYA) verifiable identity layer natively into hCaptcha, the bot protection platform that guards millions of sites and apps, letting protected websites cryptographically validate KYA credentials and permit authorized AI agents under merchant-defined policies. KYA tokens are signed credentials carried in agents' HTTPS request headers that convey agent identity, verified user identity, authorization scope and transaction context, and hCaptcha now folds those signals into its existing policy engine and agent scoring without requiring a separate Skyfire verification service. The integration targets agentic commerce, where shopping agents and financial assistants look like malicious automation to systems built to treat all bots as suspicious.

hCaptcha integrates Skyfire’s Know Your Agent KYA , enabling websites to recognize, verify, and authorize trusted AI agents through existing security infrastructure. AI agents are increasingly navigating websites, accessing accounts, and completing transactions on behalf of consumers. The security infrastructure protecting those websites was largely designed for a world where automated traffic was assumed to be suspicious. Today, Skyfire is expanding the answer through native KYA support in hCaptcha. One of the industry’s largest bot protection and security platforms, hCaptcha protects millions of sites and apps from automated and human abuse, including agentic fraud. With this integration, hCaptcha cryptographically validates Skyfire KYA credentials and incorporates verified agent identity into its security policy engine and agent scoring systems. Websites protected by hCaptcha can now configure policies to recognize and permit KYA-verified agents, without requiring a new agent identity integration. From Blocking Bots to Enabling Trusted Agents Across the internet, bot management and fraud/risk platforms are the critical gatekeepers for the internet, protecting websites against malicious automation. AI agents are changing the equation since they often look like malicious automation but represent real customers with purchase intentions. A personal shopping agent purchasing a product, a financial assistant accessing an account, and a malicious bot attempting credential stuffing may all appear to be automated traffic. Their identities, authorization, and intentions, however, are very different. Skyfire’s Know Your Agent KYA network introduces a verifiable identity and authorization layer for AI agents. KYA tokens are cryptographically signed credentials that can communicate: - Agent identity: Which AI agent and platform initiated the request. - Verified user identity: Who the agent represents, when that identity has been verified. - Authorization: What actions the agent is permitted to perform on the user’s behalf. - Transaction context: Relevant intent, mandates, and risk signals. These credentials travel directly with the agent’s HTTPS requests, allowing participating security providers to independently validate them and apply appropriate access policies. The result is a fundamental shift: websites and their existing security stacks can evaluate automated traffic based not only on behavioral signals, but also on verified identity and authorization. hCaptcha Adds Native KYA Acceptance Through this integration, hCaptcha has implemented native recognition and validation of Skyfire KYA tokens within its existing security infrastructure. This enables hCaptcha-protected websites to: 1. Recognize verified AI agents. Validate KYA credentials presented by agents in standard request headers. 2. Apply identity-aware security policies. Configure access for KYA-verified agents across specific pages, workflows, or entire websites. 3. Incorporate verified identity into agent scoring. Use KYA signals alongside hCaptcha’s existing detection and reputation systems. 4. Enable legitimate agentic activity. Allow authorized AI agents to access protected experiences under merchant-defined security policies. Importantly, the integration operates within hCaptcha’s existing policy engine. Websites do not need to deploy a separate Skyfire verification service to take advantage of KYA recognition. This creates a path for businesses to enable AI agents while retaining control over security, fraud prevention, and access policies. Building the Acceptance Network for Agentic Commerce The hCaptcha integration represents another step in Skyfire’s broader strategy: making verified AI agent identity interoperable across the infrastructure that already protects the internet. Skyfire is building a network that connects AI agents, identity providers, bot management platforms, fraud prevention systems, payment providers, and merchants. Our expanding acceptance ecosystem includes integrations and collaborations across major security infrastructure providers such as Akamai, Cloudflare, DataDome, Fastly, F5, Imperva, Cequence and others now includes hCaptcha. Together, these integrations are establishing a common mechanism for websites to recognize trusted agents through their existing security infrastructure. Rather than requiring every AI platform to negotiate individual access arrangements with every merchant, KYA enables agents to present portable, verifiable credentials that participating security providers can recognize. And rather than requiring merchants to build custom agent authentication systems, KYA allows them to leverage the security platforms they already use. One agent identity. A growing network of acceptance. No new identity integration required at every website. Why This Matters for the Agent Economy The success of agentic commerce will depend on more than an AI agent’s ability to browse a website or initiate a payment. Agents must also be able to reliably access protected properties, authenticate on behalf of consumers, and complete authorized actions without being mistaken for malicious automation. That requires coordination across the entire transaction lifecycle. Skyfire’s KYA network provides a shared identity and authorization framework, while infrastructure partners such as hCaptcha enable that trust to be evaluated at the point of access. For AI agent platforms , this means a growing network of websites capable of recognizing verified agent credentials. For merchants , it means a way to enable agentic traffic while preserving existing security controls. For security providers , it means incorporating cryptographically verifiable identity and authorization signals into existing bot management and fraud detection systems. And for consumers , it creates a foundation for AI agents to act on their behalf with clearer accountability and authorization. The Internet Needs to Know Who Its Agents Are The next generation of internet traffic won’t be exclusively human. Increasingly, consumers will delegate everyday activities to AI agents, from shopping and financial services to travel, account management, and beyond. The infrastructure protecting the internet must evolve accordingly. With hCaptcha’s native KYA integration, another major security platform now recognizes verified AI agent identity and uses it to inform access decisions. The future of agentic commerce isn’t about removing security barriers. It’s about giving security infrastructure the identity and authorization signals needed to distinguish trusted agents from malicious bots. That’s the network Skyfire is building. And with hCaptcha, that network continues to expand. About Skyfire Skyfire is building the interoperable identity and authorization network for AI agents. Through its Know Your Agent KYA standard, Skyfire enables agents to prove their identity, represent verified users, and communicate authorization to websites, security providers, and payment platforms. Skyfire’s expanding acceptance network helps AI agents securely access and transact across the internet. Learn more at skyfire.xyz https://skyfire.xyz/ .