Envoy gives AI agents their own login—without breaking yours

Envoy lets AI agents in without touching login code

Descope rolled out Envoy yesterday, a service that lets consumer apps accept AI agents as users without rewriting their existing sign-in code. The move comes after Amazon.com Inc. and JPMorgan Chase & Co. blocked agents like Meta’s Muse over fears of fraud and unclear accountability. Envoy sidesteps those roadblocks by giving each agent its own identity, separate from the human behind it.

Two IDs, one session: how Envoy separates agent and human

Instead of lumping agent and customer together, Envoy treats them as two distinct actors. Every login, session token, and log entry records both identities—so companies can revoke an agent’s access anytime without booting the customer. The underpinning is a proposed standard called the Personal Agent Protocol (Poppy), co-authored by Meta and Sierra Technologies Inc. It defines how agents identify themselves without posing as the human who sent them.

Envoy implements Poppy by extending OAuth with two standards: Demonstrating Proof of Possession ties each session token to a key the agent holds, while Rich Authorization Requests lets businesses specify exactly what an agent is allowed to do. When an agent steps outside those bounds—say, an agent shopping on GoodRx tries to order a prescription—Envoy can ping the user’s phone for a real-time yes or no.

GoFundMe and GoodRx pilot agent logins

GoFundMe and GoodRx signed on as launch partners. GoFundMe’s chief product and technology officer Arnie Katz said the platform will keep donors and their AI agents distinct in every session and require a tap on the donor’s phone before any money moves. GoodRx, meanwhile, plans to let agents comparison-shop for prescription prices, but will lock them out of anything beyond pricing lookups.

While only two partners are live today, Descope has already banked $88 million—including a $35 million seed extension last September led by Lightspeed Venture Partners, Notable Capital, and Dell Technologies Capital.

How Envoy differs from other agent-friendly logins

1Password recently launched its own agent-friendly login, but focused on passwordless security rather than carving out a distinct agent identity. Descope founder Slavik Markovich says that gap is what Envoy fills. "Every login page on the internet was built for a person on the other side," he told SiliconANGLE. "Now there’s an agent on that line, and we give it its own seat."

Meta’s parallel play—buying AI-coding startup Conductor—targets enterprise developers rather than consumer apps, leaving Envoy a relatively open lane in the race to onboard AI agents.

What this means

Lazyfounder analysis — our interpretation, not reported fact.

Envoy creates a new option for sites that want to welcome AI agents but lack the budget or appetite to rebuild their authentication stacks.

Key takeaways

• Consumer apps can now accept AI agents without touching their existing sign-in flow.
• Every agent gets a distinct, revocable identity separate from the human user.
• Session tokens are cryptographically bound to the agent’s key, preventing impersonation.

Related on Lazyfounder

• Meta Platforms Inc.
• Amazon.com Inc.
• More technology news
• Meta acquires Conductor, AI coding startup, to integrate team and tech
• 1Password launches 1Password for Agents to secure AI-driven logins