Descope Envoy adds secure authentication for AI agents in consumer apps

The rise of agentic commerce

Personal AI agents are reaching a massive scale at a record pace. For example, Meta’s Muse surpassed 5 million downloads by the end of September, growing faster than models like ChatGPT or Claude in its early months. This rapid adoption means more people are beginning to use AI to navigate daily tasks like shopping and travel.

The infrastructure for these actions is also expanding quickly. OpenAI’s Instant Checkout currently serves roughly 900 million weekly active users, while Shopify is preparing agentic storefronts for over a million merchants. These tools allow shoppers to ask an assistant to find products, confirm sizes, and complete orders automatically.

Currently, companies face a difficult choice when these agents arrive at their websites. They can either block the agent entirely or let the agent sign in using the customer's password. Blocking agents can lead to lost revenue, while letting them use human credentials creates a situation where the business sees an impersonation rather than a legitimate delegation of power.

The problem with impersonation

When an agent uses a human's password and one-time code, the website sees a standard login. There is no record in the session logs that an AI was involved in the transaction. This lack of clarity creates significant risks for businesses regarding fraud and customer support.

If an order goes wrong or a fraud rule is triggered, the logs will point directly at the human customer. This often forces the company to absorb the costs of disputed orders, returns, and increased support volume. Because the agent is masquerading as the human, the business cannot easily distinguish between a mistake made by a person and an error made by an AI.

Some large companies have already taken a hardline stance by blocking outside agents. Amazon blocked Muse in September, and JPMorgan Chase blocked agents like Muse and Instinct from accessing customer accounts in October. However, smaller businesses may find it harder to sustain these blocks as more customers begin to route their lives through personal assistants.

Delegation via the Poppy protocol

A new standard is emerging to solve these issues called the Personal Agent Protocol, or Poppy. Developed by Meta and Sierra, this protocol allows a business to publish specific endpoints for agents. It enables the system to verify the agent's identity and issue a session that is cryptographically bound to that specific agent for the duration of the task.

Descope launched Envoy to provide an abstraction layer for this new standard. It allows developers to support agents alongside human users without having to build the Poppy protocol themselves. Envoy handles the heavy lifting of discovery, agent identification, and session tokens while keeping the customer and the agent distinct in every log entry.

By using this method, companies can revoke an agent's access without signing the human customer out. This ensures that the agent's permissions are limited and temporary. It moves the industry toward a model of augmentation, where the AI works alongside the human identity stack rather than replacing it entirely.

Granular control and approvals

Envoy includes several specific capabilities to give businesses more control over what an agent can do. One feature is Rich Authorization Requests, which allow for granular permissions. For instance, a shopping agent could be allowed to browse a catalog and place an order while being strictly forbidden from touching payment methods or account settings.

Another key feature is Client-Initiated Backchannel Authentication, also known as CIBA. This allows for out-of-band approvals for sensitive actions. If an agent finds a flight overnight, it can hold the fare and send a request to the customer's phone for a final approval the next morning.

These features help maintain trust in high-stakes environments like healthcare or finance. GoodRx, a launch partner, noted that they want to let agents access pricing information while keeping users in control of their actions. Similarly, GoFundMe plans to use Envoy to ensure that even when an agent acts for someone, the platform knows exactly who is giving and who is acting on their behalf.

Tools for agent builders

To ensure these standards are adopted quickly, Descope also released a Poppy SDK for AI agent builders. This is a zero-dependency Typescript SDK that helps developers make their agents compatible with the Personal Agent Protocol. It handles the necessary technical elements like session management and API calls required by the spec.

By providing tools for both the app developers and the agent creators, Descope aims to create a unified ecosystem. This dual approach helps ensure that as more people use personal agents, the security and identity layers of the internet can keep up with the change. It provides a way for apps to welcome agents as first-class users without rebuilding their entire identity stack.

The goal is to move away from the assumption that every login page is being accessed by a human. As AI agents become more common, these standards will define how digital identities are shared and managed. Envoy serves as a bridge for companies that want to participate in this shift without the burden of constant manual updates to evolving specifications.