PAP discovery report

printwithpoppy.com

Publishes a poppy.json with no problems found. Organization: Print with Poppy.

Publishes poppy.json

0problems

HTTP 200 Version 0.1 Sign-in direct, mediated Routes APIs Checked 1 hour ago First seen 16 Oct 2026

Open poppy.json ↗

Findings14 passed · 1 note

Discovery

OK

poppy.json published

Served over HTTPS at /.well-known/poppy.json.

§3

OK

Protocol version 0.1

A major.minor version this checker reads.

§3.1

OK

organization.domain matches the domain checked

It must match the host the agent requested, ignoring a leading www.

§3.1

Sign-in

OK

OAuth issuer: https://printwithpoppy.com

An HTTPS issuer identifier.

§3.1

OK

Sign-in types: direct, mediated

How a user can sign in through a personal agent.

§4.4

Note

Accepts credentials from personal agents (mediated)

A company offering Mediated Sign-In must rate-limit attempts and should require a one-time code when a sign-in looks unusual.

§4.7

Sign-in server

OK

OAuth server metadata published

Found at the issuer (RFC 8414).

§3.2

OK

issuer matches auth.issuer

Exact match, as agents must check.

§3.2

OK

poppy_domains lists printwithpoppy.com

The issuer confirms this domain may use it.

§3.2

OK

token_endpoint published

Issues Session and Account Tokens.

§3.2

OK

revocation_endpoint published

Revokes Account Tokens (sign-out).

§3.2

OK

authorization_endpoint published

Starts Direct Sign-In.

§3.2

Routes

OK

Offers: APIs

At least one of agent, apis or web is listed.

§3.1

APIs

OK

apis[0]: OpenAPI 3.1.0 description

Reachable, and a version the draft allows (3.0 or 3.1).

§6

Extensions

OK

Supports the operations extension

§3.3

poppy.json as served

0.8 KB

{
    "protocol_version": "0.1",
    "organization": {
        "name": "Print with Poppy",
        "domain": "printwithpoppy.com"
    },
    "auth": {
        "issuer": "https://printwithpoppy.com",
        "direct": {
            "scopes": [
                "poppy:read",
                "poppy:write"
            ]
        },
        "mediated": {
            "endpoint": "https://printwithpoppy.com/api/poppy/sign-in",
            "fields": [
                {
                    "name": "email",
                    "label": "Email",
                    "secret": false
                }
            ],
            "scopes": [
                "poppy:read",
                "poppy:write"
            ]
        }
    },
    "apis": [
        {
            "type": "openapi",
            "url": "https://printwithpoppy.com/openapi.json",
            "description": "Live store: browse the catalog, upload photos, approve home-delivered prints, pay by card and track orders. Agents without native Poppy session support should read /api/compat/instructions for the separate HTTP compatibility API; no private signing key is required."
        }
    ],
    "extensions": {
        "operations": {
            "version": "1",
            "endpoint": "https://printwithpoppy.com/api/operations"
        }
    }
}

OAuth server metadata as served

0.6 KB

{
    "issuer": "https://printwithpoppy.com",
    "token_endpoint": "https://printwithpoppy.com/oauth/token",
    "revocation_endpoint": "https://printwithpoppy.com/oauth/revoke",
    "poppy_domains": [
        "printwithpoppy.com"
    ],
    "authorization_endpoint": "https://printwithpoppy.com/oauth/authorize",
    "grant_types_supported": [
        "urn:ietf:params:oauth:grant-type:jwt-bearer",
        "authorization_code",
        "refresh_token"
    ],
    "response_types_supported": [
        "code"
    ],
    "code_challenge_methods_supported": [
        "S256"
    ],
    "scopes_supported": [
        "poppy:read",
        "poppy:write"
    ],
    "token_endpoint_auth_methods_supported": [
        "private_key_jwt"
    ],
    "dpop_signing_alg_values_supported": [
        "ES256",
        "RS256",
        "EdDSA"
    ]
}