> ## Documentation Index
> Fetch the complete documentation index at: https://darwin.so/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Authenticate

> Authenticate an Action with a provider without exposing credentials to an AI.

Authenticate lets an Action use an existing provider account without putting credentials in the conversation. Darwin treats account creation, provider access, Action approval, payment authority, and verification as separate decisions. The API continues to call the durable authorization resource a `connection`.

<Note>
  Authentication APIs described on this page are a planned preview. They are not available in the production API or MCP tool
  set yet.
</Note>

## Choose an authentication source

<CardGroup cols={3}>
  <Card title="One-time access" href="/docs/act/connections/one-time-access">
    Sign in for the current interaction. Darwin expires or consumes the assignment after the bounded work finishes.
  </Card>

  <Card title="Darwin Vault" href="/docs/act/darwin-vault">
    Reuse a credential the user explicitly saved and granted to this AI or Action.
  </Card>

  <Card title="Password manager" href="/docs/act/connections/external-vaults">
    Resolve a 1Password, Dashlane, or other supported vault reference just in time without copying the secret into Darwin.
  </Card>
</CardGroup>

For OAuth-specific authorization, continue with [OAuth](/docs/act/connections/oauth).

## Start the bound authentication

```json theme={null}
{
  "interactionId": "interaction_456",
  "expectedRevision": 2,
  "source": {
    "kind": "external_vault",
    "vaultConnectionId": "vaultconn_123",
    "itemReference": "op://Production/GitHub/token"
  },
  "saveToDarwinVault": false,
  "requestId": "repo-cleanup-connection"
}
```

The planned `authenticate_action` operation returns the current Action and, when necessary, a first-party `webLink`. Call it only when `availableActions` contains `authenticate`. OAuth authorization occurs outside the model conversation. Provider authorization URLs, authorization codes, refresh tokens, passwords, and vault secrets are never returned through the Action response.

## Keep access narrow

* Bind access to the current user, target AI, capability, interaction, provider, and requested scopes.
* Do not accept broader scopes than the interaction advertises.
* Require separate consent before converting one-time access into a saved Darwin Vault item.
* Revoke or disconnect access without deleting the Action's content-free receipt.

## Use password managers accurately

Darwin can resolve [1Password](/docs/act/connections/1password) references through an authorized service account or Connect server. A [Dashlane](/docs/act/connections/dashlane) integration uses its CLI and `dl://` secret references because Dashlane's public API does not expose vault passwords. Neither path imports a resolved secret into Darwin Vault unless the user separately chooses and authorizes that migration.

See [Darwin Vault](/docs/act/darwin-vault) for saved credential behavior.