poppy.json generator & validator

Personal AI agents are starting to shop, book and file claims for people. The Personal Agent Protocol (“Poppy”) gives them a front door: a /.well-known/poppy.json file that tells them how to sign in and which APIs and agent you offer. Build one, or check the one you have. Everything runs in your browser.

Company

Display nameDomainThe host that will serve /.well-known/poppy.json.

How agents can work with you

Website

Browser session endpoint (optional)Lets an agent's browser join the same signed-in session. Leave empty and agents browse as signed-out visitors.

Company agent (conversations)

APIs

Sign-in (OAuth)

OAuth issuer

Custom scopes

Direct sign-in (user signs in on your page)

poppy:readpoppy:write

Device sign-in (code on another device)Mediated sign-in (agent passes credentials)

/.well-known/poppy.json

{
  "protocol_version": "0.1",
  "organization": {
    "name": "Your Company",
    "domain": "example.com"
  },
  "auth": {
    "issuer": "https://auth.example.com",
    "direct": {
      "scopes": [
        "poppy:read",
        "poppy:write"
      ]
    }
  },
  "web": {}
}

✓ Valid against draft 0.1

noteorganization.domain Must equal the host that serves the file after any redirects: https://example.com/.well-known/poppy.json
noteweb No browser_session_endpoint, so personal agents browse your site as ordinary signed-out visitors.

Also required on your server

These can't be checked from the file alone.

Serve the file at https://example.com/.well-known/poppy.json over HTTPS. Redirects are allowed, but only to HTTPS URLs, and organization.domain must match the final host.
Send sensible HTTP caching headers — personal agents cache the document by them.
Publish OAuth Authorization Server Metadata (RFC 8414) for https://auth.example.com, with "issuer" exactly equal to auth.issuer and "poppy_domains" listing example.com.
The metadata must include token_endpoint and revocation_endpoint, and dpop_signing_alg_values_supported including ES256.
Direct sign-in is listed, so the metadata must include authorization_endpoint.

What is poppy.json?

It's the discovery document of the Personal Agent Protocol, an open standard from Sierra and Meta (draft 0.1, published October 2026) for how a person's AI agent works with a company on their behalf. A personal agent reads it first to learn your OAuth issuer and sign-in options, whether you offer a company agent to talk to, and which OpenAPI or MCP APIs it can call. It replaces guessing, scraping and passing as the user with an explicit, permissioned front door.

The fields at a glance

protocol_version — “0.1” for the current draft. Required.
organization — display name and the domain serving the file. Required.
auth — your OAuth issuer plus direct, device and mediated sign-in, each with the scopes it can grant. Required as soon as you list an agent, APIs or a browser session endpoint.
agent, apis, web — the ways an agent can work with you. At least one is required; you can start with only your website and add the rest later.
poppy:read and poppy:write are the two standard scopes. Your own scopes go in custom_scopes with a description; names starting with poppy: are reserved.

Should you publish one yet?

The spec is a draft and can change incompatibly before 1.0, and payments aren't covered yet. If you already have an OAuth server and an API, publishing a minimal file is cheap and lets early agents use the front door instead of scraping your pages. If you don't, the useful work right now is the groundwork: an API or MCP server for your common tasks, and sign-in that can issue scoped tokens.

Personal Agent Protocol, explained — what it means for businesses when customers send an AI instead.
Your next caller might be an AI — the phone-line version of the same shift.

Checks follow Personal Agent Protocol draft 0.1 (section 3, Discovery, and section 6, APIs), as published in October 2026. This is an independent tool, not affiliated with Sierra or Meta.