{
  "id": "poppy.identity.oauth",
  "protocol": "poppy",
  "layer": "identity-trust",
  "role": "merchant",
  "status": "required",
  "title": "Support OAuth sign-in for personal agents",
  "description": "Personal agents identify with a client metadata document and sign JWT assertions; tokens are bound with DPoP proofs.",
  "goal": "Lets a user's own agent act in their account with scoped, revocable access.",
  "note": "Draft 0.1 published 9 Oct 2026; draft 0.2 in progress with breaking changes. Sign-in variants in 0.1: direct, device and mediated.",
  "how_to_implement": {
    "steps": [
      "Run an OAuth server listed under auth.issuer in poppy.json.",
      "Accept JWT-bearer assertions from agents whose client_id is a metadata URL.",
      "Validate DPoP proofs on each request."
    ]
  },
  "resources": [
    {
      "label": "Personal Agent Protocol spec (version 0.1)",
      "url": "https://personalagentprotocol.org/docs/0.1/spec",
      "type": "spec",
      "publisher": "Personal Agent Protocol"
    }
  ],
  "audit": {
    "method": "code_review",
    "automatable": false,
    "human": "A test agent obtains a scoped token and calls an API with a DPoP proof."
  },
  "how_to_verify": "A test agent obtains a scoped token and calls an API with a DPoP proof.",
  "artifacts": [
    "client metadata document",
    "DPoP"
  ],
  "depends_on": [
    "poppy.discovery.poppy-json"
  ],
  "status_note": "Draft 0.1 published 9 Oct 2026; draft 0.2 in progress with breaking changes. Sign-in variants in 0.1: direct, device and mediated.",
  "verified": true,
  "slug": "poppy-identity-oauth",
  "category": "identity-trust",
  "url": "https://vreeman.ai/commerce/checklist#poppy.identity.oauth",
  "updated": "2026-10-19",
  "sources": [
    {
      "label": "Personal Agent Protocol spec (version 0.1)",
      "url": "https://personalagentprotocol.org/docs/0.1/spec",
      "type": "spec",
      "publisher": "Personal Agent Protocol"
    }
  ],
  "related_slugs": [
    "poppy-discovery-poppy-json"
  ]
}