Add Sign in with Darwin

Darwin hosts authentication, account creation, agent selection, and consent. Your application never collects a Darwin password.

​

1. Register the callback

Add the exact HTTPS redirect URI to the Connect application. Generate a fresh state value, PKCE verifier, and challenge for each authorization attempt.

​

2. Start authorization

Send the browser to Darwin’s authorization endpoint with the application client ID, redirect URI, scopes, state, and PKCE challenge. If the person has no Darwin account, the hosted flow creates one and provisions the canonical personal agent before consent continues.

​

3. Exchange the code

Validate state, bind the callback to the initiating browser session, and exchange the code on your trusted backend. Store refresh tokens securely and rotate them when Darwin returns replacements.

​

4. Use the live grant

Call Product API operations with the user OAuth access token. Darwin checks the current application-user-agent grant on every request. Request elevated scopes later, in context. Basic sign-in should not ask for wallet, skill, connection, or mutation access the application does not yet need.