AI Agent Identity and Verification

Question 1

What is an AI agent identity?

Accepted Answer

An AI agent identity is a verifiable identifier for an agent plus the facts that make it trustworthy: who operates it, who it acts for and what it may do. It is usually backed by cryptographic keys and can be listed in a directory or an onchain registry such as ERC-8004, a draft Ethereum standard as of October 2026.

Question 2

How does agent identity verification work across issuer, network, and merchant layers?

Accepted Answer

Each layer checks something different. The merchant verifies the agent at its website, for example through signed requests under Web Bot Auth or Visa's Trusted Agent Protocol. The network checks that the agent is registered and paying with a token issued for it. The issuer authorizes the payment against the cardholder's account and the limits they set.

Question 3

How do payment networks verify AI agents?

Accepted Answer

Card networks register or verify agents, give them tokenized credentials instead of card numbers, and let merchants check signed agent requests. Our post compares how each network does it.

Question 4

How do payment processors verify an AI agent before accepting a transaction?

Accepted Answer

A processor checks what the transaction carries: a network token issued for the agent instead of a raw card number, the agent data and trust signals the network attaches, and the merchant's own verification of the agent's signed requests. For ACP payments, it also checks that the delegated token is used within its allowance.

Question 5

How can businesses verify the identity of an AI agent?

Accepted Answer

Make the agent prove its identity. Verify a signature on its requests against a published key, as Web Bot Auth and Visa's Trusted Agent Protocol do, check its registration with the card network or in a registry such as ERC-8004 (a draft Ethereum standard as of October 2026), and confirm which verified person or business it acts for.

Question 6

How do AI agents verify digital payments?

Accepted Answer

Before relying on a payment, an agent checks the evidence that it settled: the payment response or receipt from the other side and, for onchain payments, the transaction itself. In x402, the server returns settlement details in a PAYMENT-RESPONSE header after a facilitator has broadcast the transaction and waited for confirmation.

Question 7

What is the difference between agent registries and traditional identity management?

Accepted Answer

Traditional identity management keeps users and service accounts inside one organization's directory, trusted only by that organization. An agent registry publishes agent identities so outside parties can look them up and verify them, sometimes with reputation attached. ERC-8004, a draft Ethereum standard as of October 2026, puts such a registry onchain using ERC-721 tokens.

Question 8

What are the main use cases for agent verification in payment processing?

Accepted Answer

Letting legitimate shopping agents past bot defenses at checkout, deciding whether to accept an agent's card token, approving agent-initiated invoice payments in B2B, accepting pay-per-request API payments and investigating disputes. In each case the question is the same: is this a known agent, acting for a verified customer, within its limits?

Question 9

How does agent identity verification build trust in agentic payments?

Accepted Answer

It lets each party check that an agent is genuine, accountable and within its limits before money moves, replacing trust in the agent's own claims. Our post covers how payment networks approach it.

Question 10

How is KYA different from KYC?

Accepted Answer

KYC verifies a human customer, usually once at onboarding, with documents and biometrics. KYA verifies an AI agent with digital credentials and keeps checking after onboarding, because an agent's behavior can change quickly. KYA builds on KYC: the agent's authority traces back to a person or business that passed KYC or KYB.

Question 11

What does an issuer check when an AI agent initiates a card payment?

Accepted Answer

The same things as for any card payment, plus the agent context: that the token was issued for this agent and is used within its permitted domain, the risk and trust signals the network attaches, and whether the payment fits the cardholder's limits and history. Visa is enriching tokens with more data for exactly this decision.

Question 12

What does a merchant need to check before accepting a payment from an AI agent?

Accepted Answer

That the request really comes from the agent it claims to be, by verifying its signature; that the agent is recognized through a network program or registry; that it pays with a valid token or within an approved allowance; and, where available, evidence of the user's authorization, such as an AP2 mandate.

Question 13

How does a card network know a transaction came from a legitimate agent?

Accepted Answer

It requires agents to register and be verified before they can pay, as Mastercard Agent Pay does, and issues them tokens built for agent use. Agent requests to merchants can be signed and verified through Web Bot Auth, and the token carries data the network can check when the payment arrives.

Question 14

What is an agent registry and who runs one?

Accepted Answer

An agent registry is a directory where agents are listed with an identifier, their operator and details such as service endpoints, so others can look them up. Card networks keep registries of verified agents for their programs, and ERC-8004, a draft Ethereum standard as of October 2026, defines an onchain identity registry that anyone can read.

Question 15

What is ERC-8004 and how does it handle agent identity onchain?

Accepted Answer

ERC-8004, titled Trustless Agents, is a draft Ethereum standard (as of October 2026) for discovering and trusting AI agents onchain. It defines three registries. The identity registry gives each agent an ERC-721 token whose URI points to a registration file describing the agent; separate reputation and validation registries record feedback and independent checks of its work.

Question 16

How do you bind an AI agent to the human or company that owns it?

Accepted Answer

Verify the owner first, with KYC for a person or KYB for a company, then issue the agent a credential that names that owner and is signed by whoever did the verification. The agent proves the binding by signing with its own key, and OAuth token exchange can record it as acting for the owner.

Question 17

How do you stop a fake or impersonated AI agent from making payments?

Accepted Answer

Accept only agents that prove their identity cryptographically, by signing requests with keys registered to them, instead of trusting user-agent strings or IP addresses, which can be spoofed. Check signature timestamps and nonces to block replays, bind payment tokens to the specific agent, and revoke keys quickly when an agent is compromised.

Question 18

How do websites tell a trusted AI agent apart from a bot?

Accepted Answer

By verifying a cryptographic signature on each request instead of guessing from the user agent or IP address. Under Web Bot Auth, agents sign requests with HTTP Message Signatures and publish their keys, and Visa's Trusted Agent Protocol binds the signature to the site's domain and to the action being taken.

Question 19

How does a card issuer know which AI agent is using a token?

Accepted Answer

Because the token was issued for that agent. In network agent programs such as Mastercard Agent Pay, agents are registered and pay with tokens created for them, so the token links back to the agent and the cardholder who enrolled it. Visa is also adding data on who uses a token and where.

Question 20

What is a verifiable agent credential?

Accepted Answer

A verifiable agent credential is a signed, tamper-evident statement about an AI agent, such as who operates it, who it acts for or what it may do, issued by a party that checked those facts. Anyone can verify the issuer's signature, and W3C Verifiable Credentials 2.0 is the standard data model for it.

Question 21

How do you link an agent identity to a payment token?

Accepted Answer

Issue the token to the agent, not only to the cardholder. In network programs, the agent registers first and receives a token created for it, and the token's data identifies the agent when it pays. Combined with signed requests at checkout, merchants and issuers can tie each payment to a specific agent.

Question 22

Can an AI agent have a verifiable credential?

Accepted Answer

Yes. A verifiable credential can describe any subject, including an AI agent: its operator, its principal, its permissions or certifications. The issuer signs it, the agent presents it, and the recipient checks the signature and whether the credential has since been revoked, for example through a W3C Bitstring Status List.

Question 23

What is agent attestation?

Accepted Answer

Agent attestation is evidence an agent produces about itself that a verifier can check, such as which code it runs or where it runs. The IETF's remote attestation architecture describes an attester producing evidence about its state for a verifier to appraise, and ERC-8004, a draft Ethereum standard as of October 2026, lists TEE oracles among its validation methods.

Question 24

How do you revoke an AI agent's identity or access?

Accepted Answer

Revoke it everywhere it is used: disable the agent's keys, mark its credentials revoked in their status list, cancel its payment tokens and delegated grants, and update any registry entry, such as the active flag in a registration under ERC-8004, a draft Ethereum standard as of October 2026. Then confirm that its open sessions and requests are rejected.

Question 25

Should every AI agent have its own wallet or key?

Accepted Answer

Yes, at least its own key. Separate keys let you limit, monitor and revoke one agent without touching others or the owner's main account. Whether it also needs its own funded wallet depends on how it pays; with card or delegated tokens, the scoped credential plays that role instead.

Question 26

What is Web Bot Auth and how does it relate to agent identity?

Accepted Answer

Web Bot Auth is an IETF effort, now a working group, to standardize how automated clients such as AI agents cryptographically authenticate to websites. Agents sign requests with HTTP Message Signatures and publish their keys. Visa's Trusted Agent Protocol and Mastercard Agent Pay both use it to authenticate agents.

Question 27

What information should an agent identity carry: owner, permissions, or both?

Accepted Answer

Both, kept separate. The identity carries who the agent is and who answers for it: its identifier, keys, operator and principal. Permissions change more often, so they belong in separate grants or mandates linked to that identity, which can be narrowed or revoked without reissuing the identity itself.