Clerk ships GA Poppy agent support

Agent authentication is transitioning from brittle session cookie forwarding into standardized web infrastructure. By reducing Poppy adoption to a single middleware flag, Clerk makes personal AI agent access turnkey for web applications, though developers must now grapple with scoped session security.

• –Zero-friction protocol adoption: Enabling Poppy in Next.js requires only setting `poppy: true` in middleware, which automatically serves the `/.well-known/poppy.json` discovery manifest.
• –Eliminating fragile bot workarounds: Instead of users handing raw credentials or browser cookies to autonomous agents, Poppy provides explicit OAuth delegation so apps know which agent is acting on whose behalf.
• –Scoped session risks: Because agents gain full user browser sessions, Clerk advises developers to restrict agent capabilities upfront, underscoring the urgent need for fine-grained session scoping.
• –Growing protocol momentum: Backed by Sierra, Meta, and major tech players, Poppy's rapid integration into mainstream auth providers signals it could become the standard discovery and auth layer alongside MCP.