Descope Envoy Enables AI Agents to Authenticate with Consumer Apps
Descope's new Envoy capability allows personal AI agents to authenticate with consumer applications, treating them as distinct users without requiring developers to overhaul existing authentication systems.
Descope has launched Envoy, a new capability designed to provide personal AI agents with a secure, delegated sign-in path to consumer applications. This innovation allows businesses to recognize AI agents as first-class users, complete with unique identities, permissions, and approval workflows, all without the need to re-architect their current authentication infrastructure. Several prominent companies, including GoFundMe, You.com, GoodRx, and Composio, are participating as launch and design partners, collaborating with Descope to refine Envoy's features.
The rapid proliferation of personal AI agents has reached consumer scale, with platforms like Meta's Muse experiencing faster early growth than established AI models. Concurrently, the underlying commerce infrastructure is adapting, with services like OpenAI's Instant Checkout and Shopify's agentic storefronts enabling AI-driven transactions. Consumers are increasingly leveraging these agents for tasks ranging from product discovery to completing purchases, signaling a significant shift in user interaction patterns.
Currently, consumer applications face two primary, suboptimal options when interacting with these agents. The first is to block them entirely, a strategy employed by companies like Amazon and JPMorgan Chase. While feasible for established brands, this approach risks alienating customers who prefer agent-assisted interactions and may cede revenue to more accommodating competitors. The second option is to allow agents to log in using customer credentials, a method that obscures the agent's involvement and leads to issues when fraud or errors occur, often forcing the business to absorb the costs.
A nascent standard for delegated agent access is emerging, spearheaded by the Personal Agent Protocol (Poppy) draft published by Meta and Sierra. This protocol aims to establish a framework for businesses to identify agent-specific endpoints, verify agent identities, and issue cryptographically bound sessions for the duration of an interaction.
Envoy acts as an abstraction layer for consumer application developers, simplifying the integration of agent support alongside existing human user authentication. It incorporates several key features: support for the Personal Agent Protocol, eliminating the need for developers to implement Poppy directly; granular agent permissions managed via Rich Authorization Requests (RAR), allowing businesses to precisely define agent capabilities; out-of-band approval mechanisms using Client-Initiated Backchannel Authentication (CIBA) for sensitive actions; and a clear distinction between the customer and the acting agent in all logs and tokens, enabling targeted revocation of agent access without affecting the customer's session.
"Every login page on the internet was built on the assumption that a person is on the other side, but that assumption no longer holds true," stated Slavik Markovich, CEO of Descope. "Consumer apps can either block agents or let them sign in as humans, but neither approach works in the long term. We believe the Personal Agent Protocol is doing for consumer agents what MCP did for enterprise tools, and are excited to announce Envoy to give consumer apps an easy, standards-based way to accept agent logins."
Launch partners expressed enthusiasm for Envoy's potential. GoFundMe's Chief Product and Technology Officer, Arnie Katz, highlighted the importance of distinguishing between the person and the agent for trust, noting Envoy's ability to limit agent actions and require user approval for sensitive transactions. Similarly, GoodRx CTO Nitin Shingate emphasized Envoy's role in enabling AI agents to assist users with healthcare tasks while maintaining user control and clear, limited permissions.
In conjunction with Envoy, Descope has also released a Poppy SDK for AI agent builders. This zero-dependency Typescript SDK facilitates agent compatibility with the Personal Agent Protocol, with Descope managing the complexities of discovery and client metadata generation.