Descope launches Envoy for delegated consumer AI agent sign-in
Descope Unveils Envoy, an Identity-Aware Way For Personal AI Agents to Act on People’s Behalf ↗
What happened
- Descope announced Envoy on November 4, 2026, a set of capabilities giving personal AI agents a delegated sign-in path alongside a consumer app's existing authentication flows.
- GoFundMe, You.com, GoodRx and Composio are named as launch and design partners for Envoy.
- Envoy includes Personal Agent Protocol support using Client ID Metadata Documents with no pre-registration required and DPoP-bound session tokens.
- Envoy supports Rich Authorization Requests to define agent permissions on a customer account.
- Envoy uses Client-Initiated Backchannel Authentication (CIBA) for out-of-band approval of sensitive agent actions.
- Descope published a Poppy SDK, a zero-dependency TypeScript SDK for AI agent builders.
- Envoy builds on the Descope Agentic Identity Hub, which Descope says handles authentication and access control for 1000+ MCP servers.
Why it matters to Signicat
- Envoy targets consumer-app agent login, a direct overlap with Signicat's authentication and orchestration offerings for consumer sign-in flows.
- Descope frames agent access as a standards-based alternative to blocking agents or letting them sign in as humans; this is a vendor narrative, not independently verified.
Evidence from the source (9 quotes)
- “today announced Envoy, a set of capabilities that gives personal AI agents a delegated sign-in path alongside a consumer app’s existing authentication flows” source ↗
- “GoFundMe, You.com, GoodRx, and Composio are among several launch and design partners for Envoy” source ↗
- “agent identification through Client ID Metadata Documents with no pre-registration required, session tokens bound to the agent’s key with Demonstrated Proof of Possession (DPoP)” source ↗
- “which let businesses define exactly what an agent may and may not do on a customer’s account using Rich Authorization Requests (RAR)” source ↗
- “Out-of-band approval for sensitive actions,** using Client-Initiated Backchannel Authentication (CIBA).” source ↗
- “Alongside Envoy, Descope has also published a Poppy SDK for AI agent builders. This zero-dependency Typescript SDK” source ↗
- “Envoy builds on the Descope Agentic Identity Hub, which handles authentication and access control for 1000+ MCP servers and millions of monthly agentic transactions.” source ↗
- “gives personal AI agents a delegated sign-in path alongside a consumer app’s existing authentication flows” source ↗
- “Consumer apps can either block agents or let them sign in as humans, but neither approach works in the long term.” source ↗
Agentic AI identityAuthentication passwordlessDeveloper experienceReusable identity VCProduct launchPartnershipThought leadershipGlobal
7 of 7 facts verified against the source · confidence medium · claude-haiku-5-5