Table of Contents
Don't have the time to read the entire post? Our human writers will be sad, but we understand. Summarize the post with your preferred LLM here instead.
Hey Descopers! Today Sierra and Meta released version 1.0 of the Personal Agent Protocol (Poppy), and I’m happy to share that Descope is joining as an official design partner. We’ve supported Poppy since its early drafts, and as of today, Descope Envoy fully supports 1.0.
Two of our customers are on the design partner list with us. GoFundMe and GoodRx both implemented Poppy with Envoy, with Descope providing the authentication and identity layer that lets personal agents sign in and act for their users. More on that below.
Why Poppy 1.0 matters
When Sierra and Meta published the first Poppy draft on October 9, it launched with a small group of design partners. Five weeks later, that list has passed 100 companies. That’s faster than we saw the Model Context Protocol (MCP) spread! We believe Poppy is doing for consumer agents what MCP did for enterprise tools, with both protocols giving companies and agents one standard way to connect.
With 1.0, any company can implement Poppy today. Muse, Meta’s AI agent, now checks for Poppy first on every site it visits, Shopify has turned Poppy on for every merchant on its platform, and Mercury, Synchrony, and Turkish Airlines are also going live. The Poppy 1.0 spec also lets companies adopt the protocol in stages and adds extensions, starting with a commerce extension co-authored by Shopify.
Personal agents need guardrails
Personal agents give consumer and B2B businesses a new way to reach customers and a new revenue line. However, businesses will hesitate to open that door if an agent can act on a customer’s account without consent or limits.
Poppy helps set those limits through identity. A company publishes its agent-facing endpoints, verifies the agent making each request, and issues a session that is cryptographically bound to that agent. That requires OAuth, DPoP-bound tokens, and client ID metadata documents. Most consumer apps haven’t built that infrastructure, and if one piece is misconfigured, agents can’t sign in at all.
Descope has built identity for AI agents since before Poppy existed. Agents need identities of their own, tied to the customer they act for, with permissions the business sets and the customer approves. Our Agentic Identity Hub works this way, and Envoy brings the same approach to consumer apps.
GoFundMe and GoodRx: Poppy design partners on Envoy
GoFundMe and GoodRx already trusted Descope with their customer identity. Both implemented Poppy with Envoy and are on today’s design partner list.
Every donation on GoFundMe is an act of trust, so the company needs to know who is giving and who is acting for them. With Envoy, the person and the agent stay distinct in every session, with donors approving donations from their phone before anything goes through.
GoodRx users are starting to ask personal agents to find the lowest price on a prescription and compare pharmacies before they reach the counter. Envoy gives those agents limited permissions for pricing information, while users still stay in control of what their agent does.
We’re proud to provide the Poppy authentication and identity layer for both companies, and grateful to their teams for moving so quickly.
They’re part of a larger group of Envoy launch and design partners that also includes Linktree, You.com, Elementor, and Composio. Their feedback will shape how Envoy and our Poppy support grow as more personal agents adopt the protocol.Â
What Descope brings to Poppy
For companies, Envoy lets you:
Accept agents through Poppy without implementing or maintaining the spec yourself
Define what each agent can do, and for how long
Ask customers to approve sensitive actions from their own device
Run a separate sign-in lane for agents alongside your existing one, whether or not your customer auth runs on Descope
Because Envoy works with the auth stack you already have, we can help you get agent-ready in days.
For agent builders, the Poppy JavaScript SDK connects any personal agent to a company that supports Poppy in a few lines of TypeScript. It handles discovery, sessions, Device Sign-In, and DPoP-bound API calls, with zero runtime dependencies. We’ll keep it in step with the spec as Poppy evolves.
Get started
Congratulations to the teams at Sierra and Meta, and to every company in the design partnership, on helping make Poppy 1.0 a reality.
If you run a consumer app or website, sign up for Envoy and visit our docs to get started. If you’re building a personal agent, find the Poppy SDK on GitHub. To learn more about the protocol itself, read the 1.0 spec or our Poppy explainer.
Have questions or a specific project in mind? Book a demo with our agent (and human!) auth experts.
