# description
Extension schema for io.kyalabs.common.identity — agents present a kyaLabs-issued JWT to verify identity at checkout. Obtain tokens via device auth flow (POST https://www.kyalabs.io/api/oauth/device/authorize) or API key (POST https://www.kyalabs.io/api/agent-identity). Full protocol: https://www.kyalabs.io/ucp/spec/identity

# $defs.kya_identity_object.properties.token.description
ES256-signed JWT issued by kyaLabs. Obtain via device auth flow (POST /api/oauth/device/authorize) or API key (POST /api/agent-identity). See https://www.kyalabs.io/ucp/spec/identity#obtain-token

# $defs.kya_identity_object.properties.kid.description
Key ID matching kyaLabs JWKS at /.well-known/jwks.json. Optional — can be extracted from the JWT header.