Table of Contents
Don't have the time to read the entire post? Our human writers will be sad, but we understand. Summarize the post with your preferred LLM here instead.
Hey Descopers (and any personal agents reading this blog on Descopers’ behalf)! We’re excited to share Descope Envoy with you today. Envoy is the easiest way for your website or consumer app to give personal agents like Instinct or Muse a secure, delegated sign-in path.
Your customers have started browsing and shopping with AI agents, and most consumer websites and platforms have no good way to let them in. The Personal Agent Protocol (a.k.a. Poppy) is a powerful emerging standard which fixes that: it gives businesses a way to publish what their agent-facing endpoints are, verify the identity of the agent making the request, and issue a session that is cryptographically bound to that agent for the length of the interaction. With Envoy, your consumer app can become Poppy compliant and welcome AI agents as first-class citizens without rebuilding your customer identity stack.
Sign up and visit our docs to get started. To learn more about the Why, What, and How of Envoy, keep on reading!
Building alongside the best
Personal agents have reached consumer scale in record time. The urgency of this moment is not lost on us, and it’s not lost on our customers either. To bring Envoy to market, we’re thrilled to be working alongside launch and design partners including GoFundMe, GoodRx, Linktree, You.com, Elementor, and Composio. Many of these organizations already trust Descope with their customer identity and will now provide the collaboration and feedback needed to keep enhancing Envoy in the weeks and months ahead.
Your sign-in is built for humans
Every login page, consent flow, and session on your platform assumes a person is on the other side. That assumption is breaking. Using personal agents like Muse and Instinct, shoppers now rely on an agent to perform the full end-to-end commerce story: search and find a product, pick the right size, and place the order for them.
When that agent shows up at your site, you're stuck with bad options:
Block it, and lose potential revenue.
Let it scrape and impersonate, and lose all visibility into who is acting, on whose behalf, and with what permissions. Agents misusing that access can also drive up product returns and support overhead.
Rebuild your entire CIAM stack to support agents, and spend quarters on a migration while agentic commerce explodes.
As we said with the Agentic Identity Hub 3.0, banning agents outright is not a feasible option for those looking to maximize the benefits of AI. The answer is a CIAM platform that supports agents as first-class identities alongside the people they act for.
How Envoy works
Envoy runs alongside your existing sign-in, whether or not your CIAM runs on Descope. Humans keep the experience they have today, with no change to login, consent, or user lifecycle management. Agents get a dedicated lane with their own identity, approvals, and limits. Through identity federation, you can also implement other CIAM requirements, such as multi-factor authentication (MFA), on top of Envoy.
1. Agents arrive
A shopper tells their assistant, "I want to buy a new snowboard." The agent finds and recommends an appropriate storefront, browses the catalog, confirms sizing, and gets ready to place an order. Through Poppy, Envoy verifies the agent’s identity and the customer it is acting for.
2. Users approve what agents do
Before anything happens on the customer's account, Envoy sends the user an approval request describing the exact action: the item, the size, the total. Companies can fully customize the user journey and granularity of the permissions requested by the agent with Descope Flows.
Nothing happens on a customer's behalf until they’ve seen and approved it. Approval requests appear natively wherever the customer uses their personal agent, in messaging apps like iMessage and WhatsApp, or the agent’s own dedicated app.
3. Your policies set the limits
You decide what agents are allowed to do on your site. A personal shopping agent might be able to read catalog items and place and edit orders, and nothing else. No account settings, no payment method changes, no access you didn't grant. In addition, the duration of an agent’s elevated access is also fully customizable, just like with our Agentic Identity Hub.
Supporting the ecosystem with the Poppy JavaScript SDK
While our agent-friendly CIAM platform helps companies (the organizations serving customers and their agents), we also recognize that there are plenty of identity challenges for those implementing personal agents.
With the Descope Poppy JavaScript SDK, personal agent builders can connect to any company that supports Poppy in a few lines of TypeScript. Point it at a website and the SDK discovers the company, opens a session for your user, signs them in with Device Sign-In, and calls the company’s APIs with DPoP-bound tokens it renews and revokes for you.
Poppy is still a relatively new standard, and its specification will keep changing. We’re excited to maintain the Poppy JavaScript SDK as the protocol evolves, so agent builders can meet new requirements as they’re adopted.
Get started with Envoy
As an Identity provider for AI agents, we’ve seen that identity is often a blocker to successful AI adoption. Envoy lets you securely enable personal agents on your platform, on your terms.
Sign up to get started with Envoy. Have questions or a specific project you’d like to discuss? Book a demo with our agent (and human!) auth experts.
