POPPY
Test how a company identifies an agent and starts a signed-out session.
Test a company
Read its discovery document, verify its OAuth issuer, and request a signed-out session. Then check that invalid assertions and DPoP proofs are refused.
Each run starts as a new anonymous user. No account sign-in is requested.
A company can require approval. A valid signature proves identity; the company decides whether to accept the agent.
Requests and checks
Specification ↗No requests yet.
Each result shows the protocol rule, the request, and the response.
Inspired by poppy-simulator.stacktr.ee by stevy_smith.