Ora officially joins the Personal Agent Protocol

• A company publishes one file, /.well-known/poppy.json. It names the company, its APIs, its website and its own agent, and the access an agent can ask for.
• The person signs in on the company's own page, through standard OAuth, and chooses what to grant. The agent never holds the password.
• One session covers API calls, conversations and web pages, so the company sees one customer across all three.
• Companies start from what they already run: OpenAPI, MCP, web pages, or a company agent of their own.

A protocol only works if companies implement it correctly. One wrong field in poppy.json, one missing line in the sign-in metadata, and every agent stops at the door. Nobody sees the failure. The agent just goes somewhere else.

So we started early. Draft 0.1 was published on October 9. Ora shipped its first Poppy checks the next day. Every draft since, Ora has read the spec, updated its checks and published them, and 1.0 was graded on the day it shipped.

• A full report at ora.ai/pap. ora.ai/pap/<domain> reads a company's poppy.json and checks it against the spec, one requirement per row. Every row links its section of the spec and says how serious a miss is, from one that stops every agent to a recommendation.
• The check an agent would run. Ora follows the file the way an agent does: discovery, the sign-in server, the APIs and the conversation endpoints. It sends at most six requests to a company's endpoints, and it never signs in, never joins a session and never sends a token.
• Every version, graded on its own terms. A file written for an earlier draft is graded by that draft, and the report says exactly what to change for 1.0.
• Poppy in every Ora scan. Every scan on ora.ai includes six Poppy checks, so a company sees its Poppy setup next to the rest of its agent readiness.
• A poppy.json written for you. Ora drafts one from your last scan, valid as it is, with notes on what to add for sign-in. Agents can ask for it through the generate_agent_files tool on Ora's MCP server.
• Ora can run it for you. In the managed pilot, Ora sets up and hosts your poppy.json. Join the waitlist at ora.ai/pap/managed.
• The plain guide. poppy.ax, built by Ora, explains the protocol in plain words and walks a company through setting it up.

Shopify has turned Poppy on for every merchant on its platform. Mercury, Synchrony and Turkish Airlines are going live. Every company that publishes a poppy.json this month needs to know one thing: can an agent actually get in?

That is the question Ora answers. Agents already rely on Ora to decide which products they can work with. With Poppy, Ora can tell them which companies have opened the door, and tell each company how to open it.

1. Publish /.well-known/poppy.json with "protocol_version": "1.0". Start from the draft Ora writes for you, or from the official implementation kit.
2. Point agents at your sign-in. Name your OAuth server in your domain's protected resource metadata, and list your domain in that server's metadata.
3. Run your domain through ora.ai/pap and fix what the report flags, starting with the rows that stop every agent.