PrestaShop, OpenCart and other self-hosted carts: two routes to agent-ready Free & Pro

PrestaShop, OpenCart, osCommerce, Zen Cart and their relatives share one thing with WooCommerce: they run on a server you control. That means a store on any of them can answer /.well-known/poppy.json itself, today, with a web-server rule, and can go as far as a full native implementation if a developer is willing. This page covers both routes, as of 16 October 2026. Agent Adapt is a WooCommerce plugin and has no module for these carts; it is not affiliated with or endorsed by any of their makers, nor with Sierra or Meta.

Route one: proxy a provider’s document

Since 16 October 2026 the protocol says the discovery document speaks for the host that serves it after any redirects, so a redirect to a provider’s host, which was the earlier route, no longer makes a valid document for your domain. The web server fetches the provider’s hosted document and serves it as its own instead. The proxy is a few lines.

Apache (mod_proxy, mod_proxy_http and mod_ssl enabled; in the virtual host, because .htaccess does not accept these directives):

SSLProxyEngine on
ProxyPass /.well-known/poppy.json https://hosted-document-address-for-your-store

nginx (inside the server block):

location = /.well-known/poppy.json {
    proxy_pass https://hosted-document-address-for-your-store;
    proxy_ssl_server_name on;
    proxy_set_header Host hosted-document-host;
}

The Host header is the hosted document’s hostname (agents.getagentadapt.com for Agent Adapt’s hosted Company), which the provider needs to pick the right site.

Put the rule before the cart’s catch-all rewrite, or the cart answers with its own 404 first. Then test with curl -sI https://your-store/.well-known/poppy.json: you want a 200 with content-type: application/json and no location: header. On shared hosting with no access to the virtual host, ask your host, or put the domain behind Cloudflare and use the Worker in Serving poppy.json with a Cloudflare Worker.

The provider, a hosted Company, runs the issuer and the agent API for your domain. It needs to know your catalogue and policies: PrestaShop’s webservice API and OpenCart’s REST extensions can give it that with a key you create, or it reads your public pages. The customer is handed to your checkout to pay, because the protocol gives agents no way to pay. Agent Adapt’s hosted Company for stores that cannot run its plugin is built and running, in early access by email, and not yet on sale; [email protected] takes requests.

Route two: a native module

A module that implements the protocol in the cart itself gets the customer’s real account, the real cart and no provider. The job is the same as Agent Adapt’s for WooCommerce, and the plugin’s documentation describes each part:

1. Serve poppy.json and the issuer’s OAuth metadata, generated from the store’s settings, with dpop_signing_alg_values_supported listing ES256 (required by section 3.2 since 16 October 2026). See What poppy.json is.
2. Verify agents by their published identity and keys, and keep a block list. See How your store knows which agent is calling.
3. Issue key-bound Session Tokens and check a signed proof on every call.
4. Sign customers in on your own page with a consent step, and refuse staff accounts at sign-in and on every request.
5. Publish an OpenAPI-described API for search, product details, policies, cart, orders and addresses, behind one scope check.
6. Hand off to your checkout with a single-use link, since agents cannot pay.

An agent’s first visit shows every request in order with its fields. The protocol’s guides page sets out the recommended practices for companies. The specification is Apache 2.0 at personalagentprotocol.org.

What to watch for on these carts

• Caching layers. Many PrestaShop and OpenCart hosts add full-page caching. Agent API responses carry tokens and must never be cached; mark them private and exclude the API paths.
• Combinations and options. Agents need attribute names and values in words, and a way to add a specific combination. Design the cart API around what a shopper picks.
• Multistore. One issuer per domain, or one issuer listing every domain in poppy_domains. The protocol treats domains sharing an issuer as one business.
• Older PHP. The cryptography the protocol needs (ES256 signatures, SHA-256 hashing) is standard in PHP 8 and most PHP 7 builds, but a module should set a floor and refuse to run below it, as Agent Adapt does.

Common questions

Is there an Agent Adapt module for PrestaShop or OpenCart?

No. Agent Adapt is a WooCommerce plugin. This page exists because self-hosted carts face the same questions and have the same options.

Which route first?

The proxy is an hour’s work and gets you discoverable. The module is a project that pays off in account features. Most stores should do the first and decide on the second once agents actually visit.

Does the customer still pay through my cart’s payment modules?

No. Under the protocol’s current draft the customer pays, on your checkout, with your payment modules. The agent builds the cart and hands over a link.

How do I know agents are visiting?

With a native module, your module logs them. With a provider, the provider’s dashboard shows visits. Either way, orders that arrive through an agent’s link can be tagged at the checkout, as Agent Adapt does with WooCommerce’s order attribution.