Authenticate

Authenticate lets an Action use an existing provider account without putting credentials in the conversation. Darwin treats account creation, provider access, Action approval, payment authority, and verification as separate decisions. The API continues to call the durable authorization resource a connection.

Authentication APIs described on this page are a planned preview. They are not available in the production API or MCP tool set yet.

Choose an authentication source

One-time access

Darwin Vault

Reuse a credential the user explicitly saved and granted to this AI or Action.

Password manager

Resolve a 1Password, Dashlane, or other supported vault reference just in time without copying the secret into Darwin.

For OAuth-specific authorization, continue with OAuth.

Start the bound authentication

{
  "interactionId": "interaction_456",
  "expectedRevision": 2,
  "source": {
    "kind": "external_vault",
    "vaultConnectionId": "vaultconn_123",
    "itemReference": "op://Production/GitHub/token"
  },
  "saveToDarwinVault": false,
  "requestId": "repo-cleanup-connection"
}

The planned authenticate_action operation returns the current Action and, when necessary, a first-party webLink. Call it only when availableActions contains authenticate. OAuth authorization occurs outside the model conversation. Provider authorization URLs, authorization codes, refresh tokens, passwords, and vault secrets are never returned through the Action response.

Keep access narrow

Bind access to the current user, target AI, capability, interaction, provider, and requested scopes.
Do not accept broader scopes than the interaction advertises.
Require separate consent before converting one-time access into a saved Darwin Vault item.
Revoke or disconnect access without deleting the Action’s content-free receipt.

Use password managers accurately

Darwin can resolve 1Password references through an authorized service account or Connect server. A Dashlane integration uses its CLI and dl:// secret references because Dashlane’s public API does not expose vault passwords. Neither path imports a resolved secret into Darwin Vault unless the user separately chooses and authorizes that migration. See Darwin Vault for saved credential behavior.

Get Started

Search

Act

SDKs

Interfaces

Admin

Choose an authentication source

One-time access

Darwin Vault

Password manager

Start the bound authentication

Keep access narrow

Use password managers accurately

​Choose an authentication source

One-time access

Darwin Vault

Password manager

​Start the bound authentication

​Keep access narrow

​Use password managers accurately

Choose an authentication source

Start the bound authentication

Keep access narrow

Use password managers accurately