Skip to content
Free score
AI shopping agents

Know Your Agent (KYA) for retailers: telling trusted AI shopping agents from bad bots

Know Your Agent (KYA) checks who an AI shopping agent is and who sent it. How Web Bot Auth, Visa TAP, Mastercard Agent Pay and KYA tokens work for retailers.

By the ConversionVector teamUpdated 11 min read

Contents

Direct answer: Know Your Agent (KYA) means checking an AI shopping agent before you trust it: which agent it is, who runs it, and whether a real customer has authorised what it is doing. For retailers it is arriving through three layers that fit together. First, Web Bot Auth lets an agent sign each request so your CDN can prove who sent it. Second, card-network programmes such as Visa's Trusted Agent Protocol and Mastercard Agent Pay put agents' keys in network directories and carry the customer and payment context. Third, fraud vendors add KYA tokens and registries at checkout. None of this needs a new storefront. Most of it is switched on, or not, by your CDN, bot management, payments and fraud providers, so the job is to find out what they verify and what your rules do with a verified agent.

This guide is for ecommerce directors, heads of digital, fraud and payments leads, and engineering leads. It explains what KYA covers, how each layer works, what we found when we fetched the homepages of the 225 retailers in our Agent Commerce Index as a browser and as an AI agent, and what to check first.

Last verified: 30 October 2026 against Visa's Trusted Agent Protocol specifications and launch release, Cloudflare's documentation, blog and press release, the IETF webbotauth working group, OpenAI's Help Center, AWS, Shopify's Help Center, Ant International, Walmart, Experian and Forter. Much of this is new and some of it is still in draft, so check the current versions before you plan work.

Why retailers need to know the agent

Bot management was built to answer one question: is this a human or a script? AI shopping agents break that question, because a legitimate order can now come from a script acting for a real customer. A retailer needs to tell four kinds of visitor apart:

  • A known agent with a customer behind it, such as an assistant completing a purchase the shopper approved.
  • A known agent with no customer context, such as a crawler or a research fetch.
  • A script pretending to be a known agent, by copying its user agent string.
  • A plain bad bot: scalpers, card testers, scrapers.

The user agent string cannot separate the first and third. That is the gap KYA closes. As a Forter executive put it when the company's partnership with Skyfire was reported on 22 October 2026, agentic commerce fails if retailers cannot tell an authorised buyer from a script imitating one.

The commercial pressure is real but uneven. Walmart's 21 October 2026 announcement says agents "may shop on Walmart's site through a web browser, following steps designed for people", and that this "can be slow and error-prone". Its answer is its own KYA-style layer: Agent Profiles, an MCP-based Agent Gateway and published terms for agents. Most retailers will not build that. They will rely on the shared layers below.

The three layers of Know Your Agent

LayerWhat it provesMain examplesWho usually verifies it
Agent identityWhich agent and operator sent this requestWeb Bot Auth (HTTP message signatures, RFC 9421); Cloudflare signed and verified agentsYour CDN or bot management provider
Network trust and intentThe agent is registered with a card network, and why it is here (browsing or paying)Visa Trusted Agent Protocol; Mastercard Agent PayCDN, bot management or payments provider, using the network's key directory
Customer and transactionA real customer is behind it and authorised this purchaseSkyfire KYA tokens with Forter; Experian Agent Trust; Visa and Mastercard payment credentialsPayments and fraud providers

Layer 1: Web Bot Auth, the shared identity base

Web Bot Auth lets a bot or agent sign its HTTP requests with a private key, using the HTTP message signatures standard (RFC 9421). The operator publishes its public keys at a well-known address, /.well-known/http-message-signatures-directory, and the receiving side checks the signature. A copied user agent string fails that check, because the copier does not have the key.

The IETF set up a webbotauth working group to standardise this. Its protocol document, draft-ietf-webbotauth-httpsig-protocol, was at revision 01 on 30 October 2026 and is still an Internet-Draft, not an RFC.

Support is already broad among the providers retailers use:

How to implement and test the signatures yourself is a topic of its own. For a retailer the point is this: if your edge provider verifies Web Bot Auth, a signed agent can be recognised without you maintaining user agent lists or IP ranges.

Layer 2: Visa Trusted Agent Protocol and Mastercard Agent Pay

Visa launched the Trusted Agent Protocol (TAP) on 14 October 2025. It was developed with Cloudflare and is published in the Visa Developer Center and on GitHub. Visa calls it "no-code functionality for merchants" and says it is aligned with Web Bot Auth.

What the TAP specifications say a receiving site should check:

  • The signature covers the request. The signature input includes the authority and path, created and expiry times, a key ID, the algorithm and a nonce.
  • The agent declares its intent. The tag is agent-browser-auth for browsing or agent-payer-auth for paying. Visa says a message without one of these tags "is not signed by a trusted agent".
  • It cannot be replayed. The created and expiry times must be no more than 8 minutes apart, and a nonce seen in the last 8 minutes should be blocked.
  • The keys come from Visa. Merchants or site protection providers fetch public keys from Visa's key store. Visa says a key it has issued means the agent takes part in its Visa Intelligent Commerce programme requirements.
  • It can carry more than identity. Beyond the agent signature, TAP describes consumer and device recognition and a payment container, so the same exchange can carry who the shopper is and how they will pay.

Cloudflare's 14 October 2025 press release says Mastercard is incorporating Web Bot Auth into Mastercard Agent Pay, and that American Express will also use Web Bot Auth. Cloudflare's blog post explains that agents register their keys in the Visa and Mastercard directories, so a site can check them against the network.

Visa's Intelligent Commerce Connect announcement says the platform accepts TAP alongside other agentic protocols, including ACP and UCP. Our protocol comparison explains how those fit together. Which payment programmes are live in which markets is a separate question, and it changes quickly.

Layer 3: customer and transaction trust

Identity tells you which agent arrived. It does not tell you whether this purchase is what the customer wanted. That is where fraud and identity vendors come in:

  • Skyfire and Forter. According to The Paypers' report of 22 October 2026, Forter's fraud tools now take in Skyfire's KYA protocol data, which validates both the agent and the consumer behind it. The companies said agentic orders across Forter's network had grown more than fourfold since August 2026, and that a US retailer in the pilot reached nearly 100% agentic checkout success without more chargebacks. Those are vendor-reported figures, not independent results.
  • Experian. Experian markets Agent Trust as a KYA framework that binds an agent to a verified person, with an agent trust token and an agent registry.
  • The card networks. Ant International said on 11 September 2026 that it, Mastercard and Visa had begun working on a KYA interoperability framework to "streamline agent onboarding and identification across networks" while preserving each network's own verification. No specification or timetable has been published.

Walmart's terms for AI agents show what this looks like when a retailer writes it down. Customers approve agent purchases by default, and Walmart may ask for more approval even within a spending limit. Agents "must not take actions beyond what the shopper intends" and do not receive card details. "Agents that do not follow these terms will be blocked." It is a useful model for your own policy, even if you never build an agent gateway.

What we found: who sits in front of 225 retailers

On 30 October 2026 we fetched the homepage of each of the 225 scored retailers in the Agent Commerce Index twice: once with a desktop Chrome user agent and once with OpenAI's ChatGPT-User user agent, unsigned. We read the response headers to see which edge or bot management provider served each page. We also re-tested every site that treated the two requests differently, three more times each. The fetches ran from a data-centre server, covered homepages only and claimed an identity without proving it, so they show how sites treat a claim, not a signed agent. We publish totals only, not store names.

Finding (30 October 2026)Result
Homepages served with Cloudflare headers173 of 225
Shopify stores in the Index served through Cloudflare118 of 129
Stores not on Shopify: Cloudflare / Amazon CloudFront / Akamai / Vercel55 / 15 / 9 / 7 of 96
Stores not on Shopify with no edge provider identifiable from headers11 of 96
Homepages that returned 200 to our browser request202 of 225
Of those, refused the same request with the ChatGPT-User user agent8 of 202 (seven 403s, one 429; the same result in all three re-tests)
Of those 8, refusals that were Cloudflare challenge pages5

What this means:

  • Your edge provider is your KYA provider. 173 of the 225 homepages came through Cloudflare, which documents signed-agent verification. On Shopify, the Help Center says every request to an online store "must first pass through Cloudflare", that this is always active and that it "requires no action from you". So for Shopify stores, agent identity at the edge is Shopify's call, not yours.
  • Claim-only identity gets inconsistent treatment. Most homepages served the claimed ChatGPT-User request, and a few refused it. Neither is a good outcome on its own: serving every claim lets imitators in, and refusing every claim keeps real agents out. A verified signature is the only way to make the decision on evidence.
  • The homepage is the easy part. In the Index basket test, 96 of 116 tested stores let a browsing agent reach checkout, against 8 for a page-fetching agent. Checkout is where most refusals happen, as our guide to blocking AI shopping agents explains, and where the difference between page-fetching and browsing agents matters most.

What to do this week

  1. Ask your CDN or bot management provider three questions. Do you verify Web Bot Auth signatures today? Do you verify Visa TAP and Mastercard Agent Pay agents against the network directories? What do our current rules do with a verified agent on product pages, cart and checkout?
  2. Check that nothing strips the signature. If a proxy, load balancer or second CDN sits in front of your site, make sure it passes the Signature, Signature-Input and Signature-Agent headers through unchanged, as OpenAI asks.
  3. Stop allowing by user agent string alone. Where you have rules that let named AI agents through based on their user agent, move them to verified-bot or signed-agent categories, so that imitators do not inherit the allowance.
  4. Ask your payments and fraud providers about agent orders. Can they recognise a network-registered agent or a KYA token at authorisation, and will an approved agent order be scored as a bot? Shopify Plus stores should review checkout bot protection settings for sale events with the same question in mind.
  5. Write down your agent policy. Decide which agents you welcome, what they may do, and what makes you block one. Walmart's terms are a useful starting point.
  6. Test your own store. Run the free score to see what an AI agent meets on your homepage, product pages, cart and checkout today.

Sources

Questions

What does Know Your Agent (KYA) mean in ecommerce?
Know Your Agent is the industry's name for checking an AI agent before you trust it, in the way Know Your Customer checks a person. For a retailer it means answering three questions about an automated visitor: which agent is this, who operates it, and is there a real customer behind this request who has authorised it. It is not one standard. As of 30 October 2026 it is delivered through several separate pieces: Web Bot Auth signatures, card-network programmes such as Visa's Trusted Agent Protocol and Mastercard Agent Pay, and vendor KYA tokens and registries.
Is Know Your Agent a standard?
No. The term covers several efforts. The closest thing to a shared technical base is Web Bot Auth, which uses HTTP message signatures (RFC 9421) and is being standardised by the IETF webbotauth working group; its protocol draft is still an Internet-Draft. Ant International, Mastercard and Visa said on 11 September 2026 that they had begun collaborating on a KYA interoperability framework, but they did not publish a specification or a timetable.
Can I trust an AI agent from its user agent string?
No. A user agent string is a claim anyone can copy. A signed request is different: the agent signs it with a private key, and you or your CDN check the signature against the operator's published public key. Cloudflare and AWS WAF document Web Bot Auth verification. OpenAI says the cloud browser in ChatGPT Work signs its requests this way and lists Akamai, Cloudflare, HUMAN and Vercel as providers that verify it.
Do I need to integrate Visa's Trusted Agent Protocol myself?
Usually not as a first step. Visa describes TAP as no-code functionality for merchants and lists merchants or site protection providers as the parties that fetch the agents' public keys. In practice that means your CDN, bot management or payments provider is likely to do the verification. The question to ask them is whether they verify TAP and Web Bot Auth signatures today, and what your rules do with a verified agent.
What should a Shopify store do about Know Your Agent?
Shopify says every request to an online store on Shopify passes through Cloudflare, that this protection is always on and that it needs no action from the merchant. So a Shopify store does not set its own bot rules at the edge. What it controls is checkout friction, such as Plus checkout bot protection during sales, and fraud and order-risk settings. Those should be reviewed so that an approved agent order is not declined as a bot.

Published . Last updated . More in AI shopping agents and the guide library.

Related guides