> ## Documentation Index > Fetch the complete documentation index at: https://docs.baselayer.com/llms.txt > Use this file to discover all available pages before exploring further. # Give an Agent a Verified Identity > Let sites recognize the people behind your agents, without giving the agents your users’ passwords. ## Overview An agent acts for real people, but to most sites it looks like any other bot. It gets blocked, sent through guest checkout, or asked for a password it shouldn't hold. Sites have no way to know who it acts for. Key challenges for agent builders: * Proving to a site that a verified person is behind the agent * Doing that without handing the agent the person's passwords * Sharing only what each site needs, and nothing more * Cutting off an agent fast if its key is compromised or something changes With KYA, Baselayer verifies the person once. When their agent needs to identify itself to a site, the platform's backend asks Baselayer to mint a short-lived credential for that site. * Each credential works at one site and only with the agent key it was issued for. * The platform can revoke a credential at any time, and sites refuse it in near-real time. * The credential carries identity, not spending authority or payment details. ## Choosing a credential level | Level | What the site learns | Use it when | | - | - | - | | L2 | Only that this is the same customer as last time, through the per-site ID. | The site only needs to recognize a returning customer. | | L3 | The per-site ID, the checks that passed when Baselayer verified the person, and the fields the site's KYA profile asks for. | The site needs verified details, such as an email to find an account or an address to ship to. | The same person receives the same ID at one site across agents, keys, sessions and levels. A different site receives a different ID. L2 shares only that ID. L3 can also include verification results and available fields listed in the site's KYA profile. ## How it works **1. Verify the person once** The platform sends the person through Hosted Enrollment, a Baselayer-hosted flow in the platform's brand. They enter their phone number, date of birth and country, type the code Baselayer texts them, and confirm their details. They enter their details on Baselayer's page instead of the platform's forms. A platform that already collected the person's details can send them through the API instead. Either way, the result is a stable `individual_ref`. See [Hosted Enrollment](https://docs.baselayer.com/hosted-enrollment/overview.md) and [Verifying an Identity](https://docs.baselayer.com/docs/verifying-an-identity.md). **2. Create a key for the agent** Each agent generates and holds an Ed25519 key pair. The private key stays with the agent and is never sent to the platform or Baselayer. The platform sends only the public key when it asks Baselayer to mint a credential. **3. Find out what the site needs** The agent requests a protected page. The site answers `401` with a `KYA-Disclosure-Scope` header. The agent reads the site's `/.well-known/kya-profile.json` to see the exact fields that scope may read. **4. Get a nonce** The agent calls the site's `POST /nonces` and gets a single-use nonce and the site's audience. **5. Mint a credential for that site** The platform's backend calls Baselayer with its API key, the site's audience, the agent's public key, a credential level and the fields the site's scope lists. Minting always runs on the backend, never in the agent, so the agent never holds the API key. See [Minting Credentials](https://docs.baselayer.com/docs/minting-credentials.md). **6. Present it** The agent signs the site's nonce and audience with its private key, then presents the credential to the site. If the site accepts it, the site returns its own access token. See [Presenting a Credential](https://docs.baselayer.com/docs/presenting-and-verifying-a-credential.md) for the full exchange. The platform can list credentials Baselayer minted for it, look up a credential by ID, and revoke one before it expires. See [Managing and Revoking Credentials](https://docs.baselayer.com/docs/kya-managing-and-revoking.md) and [Audit Log](https://docs.baselayer.com/docs/audit-log.md). ## What each party sees | Party | What they see | | - | - | | Site | A presentation signed by Baselayer and the agent. If it passes, the site receives a stable, site-specific customer ID, the available fields allowed by its KYA profile, and, at L3, the checks that passed. | | Agent | A single-use nonce, followed by the site's access token if the presentation is accepted. | | Person | A texted code during hosted verification. Once verified, they don't repeat the verification flow for every site visit. Each site can receive only fields listed in its KYA profile. | | Baselayer | The person's details during verification and each mint request from the platform. The site makes the access decision in its own code. | ## Recommended settings | Setting | Recommendation | | - | - | | Fields | Request only the fields listed in the site's scope. A credential that shares more is refused by the site as `SCOPE_VIOLATION`. | | Preview | Use the mint preview to see what a credential would share and skip before minting. | | Presets | Use a preset such as `consumer_ecommerce` only when its fields match the site's scope exactly. Otherwise list the scope's fields. See [Presets](https://docs.baselayer.com/docs/minting-credentials.md#presets). | | Hashes | Share a hash like `hashes.email` only when the site's scope asks for it. | | Lifetime | Keep the one-hour default. The maximum is 24 hours. Minting is a routine call, so mint again when a credential expires. | | Keys | Use a separate key for each agent. Keep the private key with the agent, or in a KMS through the KYA SDK's `AgentKey` interface (the SDK is coming soon). | | Audience | Use the audience the site returns with its nonce. Sites are matched exactly, so `shop.example` and `www.shop.example` are different. | | Revocation | Revoke with the reason that fits, such as `agent_key_compromise` or `identity_withdrawn`. Sites pick up a revocation in near-real time. | | Testing | Use a sandbox API key. Sandbox credentials come from a separate issuer that sites refuse unless they opt in. | ## Next steps * Verify a person or business: [Verifying an Identity](https://docs.baselayer.com/docs/verifying-an-identity.md) * Mint the credential: [Minting Credentials](https://docs.baselayer.com/docs/minting-credentials.md) * Present it to a site: [Presenting a Credential](https://docs.baselayer.com/docs/presenting-and-verifying-a-credential.md) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.