PAP discovery report

flowers.papsandbox.com

Publishes a poppy.json with no problems found. Organization: Northlight Flowers.

Publishes poppy.json

0problems

HTTP 200 Version 0.1 Sign-in direct, device, mediated Routes agent, APIs, web Checked 18 hours ago First seen 11 Oct 2026

Open poppy.json ↗

Findings18 passed · 1 note

Discovery

OK

poppy.json published

Served over HTTPS at /.well-known/poppy.json.

§3

OK

Protocol version 0.1

A major.minor version this checker reads.

§3.1

OK

organization.domain matches the domain checked

It must match the host the agent requested, ignoring a leading www.

§3.1

Sign-in

OK

OAuth issuer: https://flowers.papsandbox.com

An HTTPS issuer identifier.

§3.1

OK

Sign-in types: direct, device, mediated

How a user can sign in through a personal agent.

§4.4

Note

Accepts credentials from personal agents (mediated)

A company offering Mediated Sign-In must rate-limit attempts and should require a one-time code when a sign-in looks unusual.

§4.7

Sign-in server

OK

OAuth server metadata published

Found at the issuer (RFC 8414).

§3.2

OK

issuer matches auth.issuer

Exact match, as agents must check.

§3.2

OK

poppy_domains lists flowers.papsandbox.com

The issuer confirms this domain may use it.

§3.2

OK

token_endpoint published

Issues Session and Account Tokens.

§3.2

OK

revocation_endpoint published

Revokes Account Tokens (sign-out).

§3.2

OK

authorization_endpoint published

Starts Direct Sign-In.

§3.2

OK

device_authorization_endpoint published

Starts Device Sign-In.

§3.2

Routes

OK

Offers: company agent, APIs, website

At least one of agent, apis or web is listed.

§3.1

OK

Company agent reachable over Personal Agent Protocol conversations

A conversation endpoint of type poppy is listed.

§7.1

OK

Website joins the agent's session

A browser_session_endpoint is listed, so web pages apply the session's sign-in and scopes.

§5

APIs

OK

apis[0]: OpenAPI 3.1.0 description

Reachable, and a version the draft allows (3.0 or 3.1).

§6

OK

apis[1]: MCP server names the company's issuer

Its protected resource metadata lists auth.issuer in authorization_servers, so MCP clients can sign in.

§6

Extensions

OK

Supports the operations extension

§3.3

poppy.json as served

1.1 KB

{
    "protocol_version": "0.1",
    "organization": {
        "name": "Northlight Flowers",
        "domain": "flowers.papsandbox.com"
    },
    "auth": {
        "issuer": "https://flowers.papsandbox.com",
        "direct": {
            "scopes": [
                "poppy:read",
                "poppy:write"
            ]
        },
        "device": {
            "scopes": [
                "poppy:read",
                "poppy:write"
            ]
        },
        "mediated": {
            "endpoint": "https://flowers.papsandbox.com/poppy/sign-in",
            "fields": [
                {
                    "name": "email",
                    "label": "Email",
                    "secret": false
                },
                {
                    "name": "password",
                    "label": "Password",
                    "secret": true
                }
            ],
            "scopes": [
                "poppy:read",
                "poppy:write"
            ]
        }
    },
    "agent": {
        "protocols": [
            {
                "type": "poppy",
                "endpoint": "https://flowers.papsandbox.com/poppy/conversations"
            }
        ]
    },
    "apis": [
        {
            "type": "openapi",
            "url": "https://flowers.papsandbox.com/poppy/openapi.json",
            "description": "Product search, delivery dates, the customer's orders, and changes to a delivery"
        },
        {
            "type": "mcp",
            "url": "https://flowers.papsandbox.com/poppy/mcp",
            "description": "Product search, delivery dates, the customer's orders, and changes to a delivery, as MCP tools"
        }
    ],
    "web": {
        "browser_session_endpoint": "https://flowers.papsandbox.com/poppy/browser-session"
    },
    "extensions": {
        "operations": {
            "version": "1",
            "endpoint": "https://flowers.papsandbox.com/poppy/operations"
        }
    }
}

OAuth server metadata as served

1.0 KB

{
    "issuer": "https://flowers.papsandbox.com",
    "token_endpoint": "https://flowers.papsandbox.com/oauth/token",
    "revocation_endpoint": "https://flowers.papsandbox.com/oauth/revoke",
    "authorization_endpoint": "https://flowers.papsandbox.com/oauth/authorize",
    "device_authorization_endpoint": "https://flowers.papsandbox.com/oauth/device",
    "poppy_domains": [
        "flowers.papsandbox.com"
    ],
    "response_types_supported": [
        "code"
    ],
    "grant_types_supported": [
        "authorization_code",
        "refresh_token",
        "urn:ietf:params:oauth:grant-type:jwt-bearer",
        "urn:ietf:params:oauth:grant-type:device_code"
    ],
    "code_challenge_methods_supported": [
        "S256"
    ],
    "token_endpoint_auth_methods_supported": [
        "private_key_jwt"
    ],
    "token_endpoint_auth_signing_alg_values_supported": [
        "ES256",
        "RS256",
        "EdDSA"
    ],
    "revocation_endpoint_auth_methods_supported": [
        "private_key_jwt"
    ],
    "dpop_signing_alg_values_supported": [
        "ES256",
        "RS256",
        "EdDSA"
    ],
    "authorization_response_iss_parameter_supported": true,
    "client_id_metadata_document_supported": true,
    "scopes_supported": [
        "poppy:read",
        "poppy:write"
    ]
}