> ## Documentation Index > Fetch the complete documentation index at: https://docs.baselayer.com/llms.txt > Use this file to discover all available pages before exploring further. # Credentials Explained > Understand what a site can learn about the person or business behind an agent. An agent presents a KYA credential to a site to show who it acts for. The credential identifies the person or business the agent represents and says what Baselayer verified about them. Baselayer signs it as an [SD-JWT](https://docs.baselayer.com/docs/credential-format-reference.md), so the site can trust where it came from and spot any change. ## What a credential tells a site | The site's question | What the credential answers | | - | - | | Who does the agent represent? | A person, or a business and the person acting for it. | | Is this the same customer as last time? | A customer ID that's the same every time they come back to this site. | | What did Baselayer verify? | The checks that passed, such as a confirmed phone or a clear watchlist screening. | | What details does the site get? | The details the site asked for, and nothing more. | ## What information a site receives AGENT CREDENTIAL Verified identity ACTIVE Jordan Avery AUDIENCE shop.example EXPIRES In 1 hour ISSUED Just now Verified by Baselayer cred\_7f3a…c91e Example: what a store gets when it asks for a name, email and shipping address. ### Customer ID Every credential includes an ID for this customer at this site. The site can use it to recognize a returning customer, for example to bring back a saved cart. Another site gets a different ID for the same customer. ### Identity details A credential is about a person or a business. When an agent acts for a business, the acting person's details travel in their own credential alongside the business credential. A credential can carry these details. > **View all person fields** > > | Detail | Technical name | > | - | - | > | First name | `given_name` | > | Middle name | `middle_name` | > | Last name | `family_name` | > | Full name | `name` | > | Email address | `email` | > | Phone number | `phone_number` | > | Street address | `address.street_address` | > | City | `address.locality` | > | State or region | `address.region` | > | ZIP or postal code | `address.postal_code` | > | Country | `address.country` | > | Whether the address was validated by USPS | `address.usps_validated` | > | Date of birth | `birthdate` | > | Birth year | `birth_year` | > | Last four digits of the SSN | `ssn_last_4` | > | Country of residence | `residency.country` | > | State or region of residence | `residency.region` | > | Matching hash of the name | `hashes.name` | > | Matching hash of the email | `hashes.email` | > | Matching hash of the phone number | `hashes.phone_number` | > | Matching hash of the address | `hashes.address` | > | Matching hash of the SSN | `hashes.ssn` | > **View all business fields** > > | Detail | Technical name | > | - | - | > | Legal name | `name` | > | Trade names (DBAs) | `dbas` | > | EIN (federal tax ID) | `ein` | > | Business structure, such as `llc` | `structure` | > | State of incorporation | `state_of_incorporation` | > | Country of incorporation | `country_of_incorporation` | > | Date of incorporation | `date_of_incorporation` | > | Street address | `address.street_address` | > | City | `address.locality` | > | State or region | `address.region` | > | ZIP or postal code | `address.postal_code` | > | Country | `address.country` | > | Address type: registered, mailing, physical or residential | `address.address_type` | > | Email address | `email` | > | Website | `website` | > | Website domain, such as `acme.co.uk` | `domain` | > | Registration status: active, inactive or dissolved | `registration_status` | > | Matching hash of the legal name | `hashes.name` | > | Matching hash of the EIN | `hashes.ein` | > | Matching hash of the email | `hashes.email` | > | Matching hash of the address | `hashes.address` | A business credential also confirms that the person behind the agent is verified to act for that business. See [Who Can Act for a Business](https://docs.baselayer.com/docs/kya-who-can-act-for-a-business.md). The site gets only the details it asked for, and only the ones Baselayer has. It lists what it needs in its KYA profile, a file it publishes on its own domain. Baselayer never adds more, and a site that checks against its profile refuses a credential that carries extra. If Baselayer doesn't have a requested detail, the credential leaves it out. To ask for fields, see [Asking for Fields](https://docs.baselayer.com/docs/kya-asking-for-fields.md). ### What Baselayer verified The credential lists the checks that passed when Baselayer verified the person or business. > **View all person checks** > > | Check | Technical name | > | - | - | > | Phone confirmed with a texted code | `phone_possession` | > | Email confirmed with a code | `email_possession` | > | Date of birth matched the identity | `dob_identity_match` | > | Identity number matched the identity | `ssn_identity_match` | > | Watchlists clear | `watchlist_clear` | > **View all business checks** > > | Check | Technical name | > | - | - | > | Matched a record in its home state registry | `registry_record_found` | > | IRS matched the business name and tax ID | `tax_id_match` | > | State registration is active | `registration_active` | > | The acting person is an officer on the registration | `actor_is_officer` | > | Watchlists clear | `watchlist_clear` | A site can set rules on specific checks, such as requiring a clear watchlist result before checkout. For how checks are carried inside the credential, see [the verification block](https://docs.baselayer.com/docs/credential-format-reference.md#the-verification-block). ## Built-in safeguards | Safeguard | In plain language | | - | - | | Identity, not permission | It says who the agent acts for. The site still decides what the agent may do, including whether it can pay. | | Agent-bound | It's tied to the agent's own key, so another agent can't present it. | | Site-bound | It names the site it was made for and answers a one-time challenge, so it can't be used at another site or replayed. | | Different ID at each site | Each site gets its own customer ID for the same person or business. | | Short-lived | It works for one hour by default, up to 24 hours, and can be [revoked](https://docs.baselayer.com/docs/kya-managing-and-revoking.md) earlier. | ## Where to go next See what you can do with KYA credentials: * [Let Shopping Agents Check Out](https://docs.baselayer.com/docs/kya-playbook-merchants.md): let verified agents shop, sign in and check out at your store. * [Give an Agent a Verified Identity](https://docs.baselayer.com/docs/kya-playbook-agent-builders.md): let sites recognize the people behind your agents. * [Know Who's Behind Agent Traffic at the Edge](https://docs.baselayer.com/docs/kya-playbook-edge.md): check who an agent represents before its request reaches your origin. * [Agents Acting for a Business](https://docs.baselayer.com/docs/kya-playbook-b2b.md): show which business an agent represents and who is acting for it. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.