PAP discovery report

notjustabank.com

Publishes a poppy.json with no problems found. Organization: North & Pine Card — powered by Not Just a Bank.

Publishes poppy.json

0problems

HTTP 200 Version 0.1 Sign-in direct Routes APIs, web Checked 3 hours ago First seen 17 Oct 2026

Open poppy.json ↗

Findings1 warning · 15 passed · 1 note

Discovery

OK

poppy.json published

Served over HTTPS at /.well-known/poppy.json.

§3

OK

Protocol version 0.1

A major.minor version this checker reads.

§3.1

OK

organization.domain matches the host that serves it

It must be the host that serves the document, after any redirects, compared ignoring case.

§3.1

Sign-in

OK

OAuth issuer: https://notjustabank.com

An HTTPS issuer identifier.

§3.1

OK

Sign-in types: direct

How a user can sign in through a personal agent.

§4.4

Warning

direct: custom scope northpine:payment_tokens has no description

Companies describe each scope they define in auth.custom_scopes, so agents can explain it to users.

§3.1, §4.4

Sign-in server

OK

OAuth server metadata published

Found at the issuer (RFC 8414).

§3.2

OK

issuer matches auth.issuer

Exact match, as agents must check.

§3.2

OK

poppy_domains lists notjustabank.com

The issuer confirms this domain may use it.

§3.2

OK

DPoP algorithms published: ES256

dpop_signing_alg_values_supported lists ES256, which every company must accept.

§3.2, §4.3

OK

token_endpoint published

Issues Session and Account Tokens.

§3.2

OK

revocation_endpoint published

Revokes Account Tokens (sign-out).

§3.2

OK

authorization_endpoint published

Starts Direct Sign-In.

§3.2

Routes

OK

Offers: APIs, website

At least one of agent, apis or web is listed.

§3.1

Note

Website: signed-out browsing

No browser_session_endpoint, so personal agents browse the site as ordinary signed-out visitors.

§5

APIs

OK

apis[0]: OpenAPI 3.1.0 description

Reachable, and a version the draft allows (3.0 or 3.1).

§6

Extensions

OK

Supports the operations extension

§3.3

poppy.json as served

0.6 KB

{
    "protocol_version": "0.1",
    "organization": {
        "name": "North & Pine Card — powered by Not Just a Bank",
        "domain": "notjustabank.com"
    },
    "auth": {
        "issuer": "https://notjustabank.com",
        "direct": {
            "scopes": [
                "poppy:read",
                "poppy:write",
                "northpine:payment_tokens"
            ]
        }
    },
    "apis": [
        {
            "type": "openapi",
            "url": "https://notjustabank.com/poc/bank/openapi.json",
            "description": "Read fictional North & Pine card balances and transactions",
            "resource": "https://notjustabank.com/poc/bank/api"
        }
    ],
    "web": {},
    "extensions": {
        "operations": {
            "version": "1",
            "endpoint": "https://notjustabank.com/poc/bank/operations",
            "resource": "https://notjustabank.com/poc/bank/api"
        }
    }
}

OAuth server metadata as served

0.8 KB

{
    "issuer": "https://notjustabank.com",
    "authorization_endpoint": "https://notjustabank.com/poc/bank/oauth/authorize",
    "token_endpoint": "https://notjustabank.com/poc/bank/oauth/token",
    "revocation_endpoint": "https://notjustabank.com/poc/bank/oauth/revoke",
    "poppy_domains": [
        "notjustabank.com"
    ],
    "response_types_supported": [
        "code"
    ],
    "grant_types_supported": [
        "urn:ietf:params:oauth:grant-type:jwt-bearer",
        "authorization_code",
        "refresh_token"
    ],
    "token_endpoint_auth_methods_supported": [
        "private_key_jwt"
    ],
    "token_endpoint_auth_signing_alg_values_supported": [
        "ES256"
    ],
    "code_challenge_methods_supported": [
        "S256"
    ],
    "scopes_supported": [
        "poppy:read",
        "poppy:write",
        "northpine:payment_tokens"
    ],
    "dpop_signing_alg_values_supported": [
        "ES256"
    ],
    "authorization_response_iss_parameter_supported": true
}