Sierra and Meta's Poppy draft gives AI agents a standard way to sign in to businesses: OAuth tokens, three login routes, 35 more design partners, payments still missing
Draft 0.1 of Personal Agent Protocol is public under Apache-2.0 with 35 more design partners named. Verdict: read the auth sections now, implement nothing until the reference code and a 0.2 arrive.
Poppy is built on the principle that customers decide what access to give their personal agents, and companies set parameters for what those agents can do.
Comprehensive take
Poppy's value is in its auth design (scoped OAuth sessions, DPoP, a tightly constrained credential-passing route), not its backer list; it is a draft with no reference implementation, no payments and rivals in the field.
Use cases
Agent builders
Study the session, scope and DPoP model as a template for giving an agent read-only versus write access to a user account without sharing a password.
Security and identity teams
Review the mediated sign-in rules (rate limits, no credentials echoed, one-time codes) before any agent is allowed to log in on a customer's behalf.
Retail, bank and travel platform owners
Plan for a poppy.json file and scope list, but wait for the reference implementation and a stable version before committing engineering time.
Specs
| Status | Draft 0.1; any part may change, including incompatibly source |
|---|---|
| Licence | Apache License 2.0 source |
| Discovery | /.well-known/poppy.json on the company domain source |
| Sign-in types | Direct (OAuth code + PKCE), Device, Mediated (credentials to company endpoint) source |
| Token binding | DPoP for OpenAPI; Bearer, one server only, for MCP (2025-06-18 or later) source |
| Additional design partners | 35 (e.g. OpenAI, Visa, Mastercard, PayPal, Cloudflare, Okta) source |
| Payments | Future extension, not in 0.1 source |
Insights
- Axion reading: mediated sign-in is the pragmatic bridge for companies without agent-ready OAuth, and also the largest phishing surface; the spec pushes the burden onto the company by requiring rate limits and forbidding credential echo.
- Axion note: Sierra sells company-side agents, one of the three channels Poppy offers, so its framing of that channel should be read with that interest in mind.
- Axion note: Sierra says the 35 partners will take part in design; none has announced a production implementation.
What shipped
Sierra, the customer-service agent company run by Bret Taylor and Clay Bavor, and Meta announced Personal Agent Protocol, nicknamed Poppy, on 6 October. Days later Sierra published a draft 0.1 specification, ahead of the "later this month" timing it had given, plus 35 more design partners. The named list includes OpenAI, Visa, Mastercard, PayPal, Cloudflare, Okta, Notion, Zapier and 1Password, on top of the launch group of Genesys, Instinct, Rocket, Shopify, Stripe and Walmart. The spec is Apache-2.0 licensed and says plainly that any part of it can change before a stable version, including in ways that break backward compatibility.
What is actually in the draft
Poppy is not another agent-to-agent chat format. It covers the part that usually breaks first: how a personal agent finds a company, proves who it is, and gets only the access its user approved. A company publishes one JSON file at /.well-known/poppy.json listing its OAuth issuer, the sign-in types it supports, its APIs (OpenAPI or a remote MCP server) and optionally its own company agent. Session tokens are ordinary OAuth access tokens and account tokens are refresh tokens, so an existing authorization server can issue them. APIs use DPoP-bound tokens; MCP servers get Bearer tokens limited to one server.
Three sign-in routes are defined. Direct sign-in is a standard authorization-code flow with PKCE (S256). Device sign-in uses a code the user approves on the company's page. Mediated sign-in lets the agent post the user's credentials, such as email and password, to a company-published endpoint. That last route is the contentious one, and the spec is blunt about it: companies that offer it MUST rate-limit attempts, MUST NOT return credentials in any response and SHOULD require a one-time code when a sign-in looks unusual, and agents MUST NOT send credentials anywhere else. Scopes start with poppy:read and poppy:write, with company-defined scopes allowed. Rate limits use HTTP 429 with Retry-After. Browser use is optional, via a browser-session endpoint, and conversations run as JSON over HTTPS with streaming and a handoff-to-human call.
What is not settled
Payments are listed as a future extension, not part of 0.1. Sierra says a reference implementation and design workshops will come over the next month, so nobody can yet test an interoperable agent and company pair. A design partner is also not an implementer: Sierra's wording is that the 35 companies will participate in the design process. The TNW report notes Stripe and Shopify have also joined a rival protocol run by Visa, and Sierra frames Poppy as complementary to the Universal Commerce Protocol, which targets shopping. Two vendor lists also differ: Meta's announcement names NiCE and Decagon, Sierra's does not.
Axion take
If you build agents that touch customer accounts, read sections 4 and 8 of the draft now. It is a worked example of how to give an agent narrow, revocable, per-session access without handing it a password, and most of it is plain OAuth you already know. If you run a company site, the cheap first step is watching how the spec lands rather than implementing a moving target. Treat the 'millions of users' and partner-count claims as Sierra's and Meta's own, and remember Sierra sells the company-side agents that Poppy routes traffic to.