Magento and Adobe Commerce: implementing the Personal Agent Protocol on a store you host Free & Pro

Magento Open Source runs on your own server, which puts it in the same strong position as WooCommerce: a store can publish the discovery file, run the issuer and answer agents from its real catalogue and customer accounts, with nothing in the middle. Adobe Commerce on Adobe’s cloud is hosted, but it still gives you control of routing through Fastly. This page says what each needs, as of 16 October 2026. Agent Adapt is a WooCommerce plugin; there is no Agent Adapt module for Magento, and this page is written so a Magento developer can do the work without one. Agent Adapt is not affiliated with or endorsed by Adobe, Sierra or Meta.

The quick route: proxy a provider’s document

The least work is a proxy for one path: the web server fetches the provider’s hosted document and serves it as its own. It has to be a proxy rather than a redirect, because since 16 October 2026 the protocol says the document speaks for the host that serves it after any redirects, so a redirect to the provider’s host no longer makes a valid document for your domain. In nginx, inside your server block:

location = /.well-known/poppy.json {
    proxy_pass https://hosted-document-address-for-your-store;
    proxy_ssl_server_name on;
    proxy_set_header Host hosted-document-host;
}

The Host header is the hosted document’s hostname (agents.getagentadapt.com for Agent Adapt’s hosted Company), which the provider needs to pick the right site.

On Apache, with mod_proxy, mod_proxy_http and mod_ssl enabled, in the virtual host (these directives are not accepted in .htaccess):

SSLProxyEngine on
ProxyPass /.well-known/poppy.json https://hosted-document-address-for-your-store

Test with curl -sI https://your-store/.well-known/poppy.json: you want a 200 with content-type: application/json and no location: header. On Adobe Commerce cloud you do not control nginx, so the proxy has to be done in front of the store: if your domain’s DNS is on Cloudflare with the proxy on, a Cloudflare Worker serves the document before Fastly does, as in Serving poppy.json with a Cloudflare Worker; we have not confirmed a Fastly-only recipe ourselves. The provider then runs the issuer and the agent API for your domain, reads your catalogue through Magento’s REST or GraphQL APIs with an integration token you create, and hands customers to your checkout. The proxy rules are the same as for any platform; see Making any website agent-ready. Agent Adapt’s hosted Company is such a provider: built and running, in early access by email, and not yet on sale; [email protected] takes requests.

The full route: a native module

A store that implements the protocol itself gets the customer’s real account, the real cart and one domain. What a Magento module has to do is the same list Agent Adapt’s plugin does for WooCommerce, and the plugin’s documentation is a usable specification of it. In order:

1. Serve poppy.json at the root, naming the store and an issuer on the same domain, and serve the issuer’s OAuth metadata (RFC 8414) listing the token, authorization, device and revocation endpoints, poppy_domains, and dpop_signing_alg_values_supported with ES256 in it, which section 3.2 has required since 16 October 2026. See What poppy.json is.
2. Verify agents. An agent identifies itself by an HTTPS URL where it publishes its name and keys. Fetch that document without following redirects, cache it, verify the agent’s signed assertion against the published keys, and keep a block list. See How your store knows which agent is calling.
3. Issue DPoP-bound Session Tokens and check a signed, single-use proof on every API call, with a replay cache shared across your web nodes.
4. Sign customers in with a consent page on your own domain, OAuth authorization code with PKCE, and an optional device code flow. Refuse admin accounts at sign-in and on every request.
5. Expose an OpenAPI-described API for catalogue search, product details, policy pages, a cart, orders and addresses, with one scope check that every call goes through.
6. Hand off to checkout. The draft gives agents no way to pay. A single-use link that loads the agent’s cart into the customer’s browser session and lands on your checkout is how Agent Adapt solves it, advertised as an extension named with our domain. Your module would name its own.

The full request-by-request sequence an agent follows is in An agent’s first visit, and the protocol’s own guides page lists the recommended practices for companies (shared scope checks, uniform 404s, token lifetimes, key rotation). The specification is at personalagentprotocol.org, Apache 2.0.

Things Magento makes easy and hard

• Customer groups and tier prices. The API should return the price the signed-in customer would see, which Magento can compute per group. A signed-out agent gets the default group’s prices. B2B stores should read B2B and wholesale.
• Configurable and bundle products. Agents need attribute names and values in words, and a way to add a specific child. Plan the cart API around what a human picks on the product page.
• Full-page cache and Varnish. Agent responses carry tokens and must not be cached. Mark them private and exclude the API paths from Varnish and Fastly, as you would for the customer section.
• Multi-store, multi-website. One issuer per store view’s domain, or one issuer listing every domain in poppy_domains. The protocol treats domains sharing an issuer as one business.

What to do this month

1. Fetch https://your-store/.well-known/poppy.json. On a self-hosted store you will get your own 404, which means the path is yours to use.
2. Decide between the proxy and the module. The proxy is an afternoon; the module is a project.
3. Make your policy pages say their substance in text. Either route quotes them to customers.

Common questions

Is there an Agent Adapt extension for Magento?

No. Agent Adapt is a WooCommerce plugin. This page exists because the questions are the same on any platform you host yourself.

Does the customer still pay on my Magento checkout?

No. Under the protocol’s current draft the customer pays, on your checkout, with your payment methods. The agent builds the cart and hands over a link.

Does the module have to support MCP?

No. The protocol lets a store offer an OpenAPI API, an MCP server, or both. Start with OpenAPI; agents are told to skip API types they do not understand.

How do I keep admin accounts out?

Check the account’s role at sign-in and again on every API request, and refuse anything with admin capabilities. Roles change after sign-in; a check only at sign-in is not enough.