PAP Checker/Sites/you.com

PAP discovery report

you.com

Publishes a poppy.json with 2 problems to fix. Organization: You.com.

Publishes poppy.json, with problems

2problems

HTTP 200 Version 0.1 Sign-in device Routes web Checked 18 hours ago First seen 1 Nov 2026

Open poppy.json ↗

Findings2 problems · 10 passed · 3 notes

Discovery

poppy.json published

Served over HTTPS at /.well-known/poppy.json.

§3

Note

No Cache-Control header

Personal agents should cache the document according to its HTTP caching headers.

§3

Protocol version 0.1

Checked against the rules of draft 0.1, the version the document declares.

§3.1

organization.domain matches the domain requested

Under draft 0.1 it must match the domain the agent asked for, ignoring case and a leading www.

§3.1 (0.1)

Sign-in

OAuth issuer: https://auth.you.com/v1/apps/P2jInttRMuXpyYZMbVcsc4C9Z0RT

An HTTPS issuer identifier.

§3.1

Sign-in types: device

How a user can sign in through a personal agent.

§4.4

Sign-in server

OAuth server metadata published

Found at the issuer (RFC 8414).

§3.2

issuer matches auth.issuer

Exact match, as agents must check.

§3.2

Problem

poppy_domains is missing

The issuer metadata must list every domain whose poppy.json names it. Without it agents must not use this document, so no other domain can claim the issuer.

How to fix →

§3.2

Note

DPoP algorithms published: RS256, RS384, RS512, PS256, PS384, PS512, ES256, ES384, ES512, EdDSA

Draft 0.1 sets no rule on which DPoP algorithms a company accepts. From draft 0.2, companies must accept ES256 and a published list must include it.

§3.2

token_endpoint published

Issues Session and Account Tokens.

§3.2

revocation_endpoint published

Revokes Account Tokens (sign-out).

§3.2

Problem

device_authorization_endpoint missing

Required: it starts Device Sign-In.

§3.2

Routes

Offers: website

At least one of agent, apis or web is listed.

§3.1

Note

Website: signed-out browsing

No browser_session_endpoint, so personal agents browse the site as ordinary signed-out visitors.

§5

poppy.json as served

0.2 KB

{
    "protocol_version": "0.1",
    "organization": {
        "name": "You.com",
        "domain": "you.com"
    },
    "auth": {
        "issuer": "https://auth.you.com/v1/apps/P2jInttRMuXpyYZMbVcsc4C9Z0RT",
        "device": {
            "scopes": [
                "openid"
            ]
        }
    },
    "web": {}
}

OAuth server metadata as served

1.4 KB

{
    "issuer": "https://auth.you.com/v1/apps/P2jInttRMuXpyYZMbVcsc4C9Z0RT",
    "jwks_uri": "https://auth.you.com/P2jInttRMuXpyYZMbVcsc4C9Z0RT/.well-known/jwks.json",
    "authorization_endpoint": "https://auth.you.com/oauth2/v1/apps/authorize",
    "response_types_supported": [
        "code"
    ],
    "subject_types_supported": [
        "public"
    ],
    "id_token_signing_alg_values_supported": [
        "RS256"
    ],
    "token_endpoint": "https://auth.you.com/oauth2/v1/apps/token",
    "userinfo_endpoint": "https://auth.you.com/oauth2/v1/apps/userinfo",
    "scopes_supported": [
        "openid",
        "profile",
        "email",
        "phone",
        "offline_access"
    ],
    "claims_supported": [
        "iss",
        "aud",
        "iat",
        "exp",
        "sub",
        "name",
        "email",
        "email_verified",
        "phone_number",
        "phone_number_verified",
        "picture",
        "family_name",
        "given_name"
    ],
    "revocation_endpoint": "https://auth.you.com/oauth2/v1/apps/revoke",
    "token_endpoint_auth_methods_supported": [
        "client_secret_basic",
        "client_secret_post"
    ],
    "code_challenge_methods_supported": [
        "S256"
    ],
    "backchannel_token_delivery_modes_supported": [
        "poll"
    ],
    "backchannel_authentication_endpoint": "https://auth.you.com/oauth2/v1/apps/bc-authorize",
    "dpop_signing_alg_values_supported": [
        "RS256",
        "RS384",
        "RS512",
        "PS256",
        "PS384",
        "PS512",
        "ES256",
        "ES384",
        "ES512",
        "EdDSA"
    ],
    "grant_types_supported": [
        "authorization_code",
        "refresh_token",
        "client_credentials",
        "urn:openid:params:grant-type:ciba",
        "urn:ietf:params:oauth:grant-type:jwt-bearer",
        "urn:ietf:params:oauth:grant-type:token-exchange"
    ],
    "authorization_grant_profiles_supported": [
        "urn:ietf:params:oauth:grant-profile:id-jag"
    ]
}

Each document is checked against the Personal Agent Protocol draft it declares in protocol_version: 0.1, 0.2 or 0.3. Section numbers refer to that draft's specification. Drafts 0.1 and 0.2 are published and frozen; draft 0.3 is in progress, and any draft can change before a stable version; see the path to 1.0.