Skip to main content
Connect uses different credentials for different trust boundaries. Do not use one credential as a substitute for another. Send API keys, service-account tokens, and OAuth access tokens as bearer credentials:
Keep application credentials on a trusted backend. Never put them in browser code, mobile bundles, logs, URLs, or model-visible prompts.

​
Linked-agent authorization

Sign in with Darwin uses authorization code flow with PKCE. The access token is limited by the user’s current application, agent, and scope grants. Darwin reevaluates those grants on every call, so access can stop before the token expires.

​
Owner-only actions

A Connect app cannot reuse the user’s saved Darwin payment method, withdraw their earnings, or retrieve provider credentials. When an owner-only action is required, open the Darwin-hosted flow returned by the API.

Add Sign in with Darwin

Implement authorization, account creation, agent selection, and consent.