OAuth authentication - Darwin

OAuth lets a user authorize provider access without putting authorization URLs, codes, access tokens, or refresh tokens in an AI conversation. The resulting authorization is represented as a connection in the API.

Complete the browser step

When OAuth is required, the planned Authenticate operation returns a first-party webLink. Darwin validates the current interaction and Action revision before starting the provider flow.

connection_required -> first-party Darwin page -> provider authorization
                    -> verified callback -> same Action resumes

Requested scopes cannot exceed the bound authentication interaction. If the provider or scope set changes, Darwin requires a new authorization.

Choose retention explicitly

The user can authorize the connection for this Action only or explicitly save the resulting credential in Darwin Vault. Provider authentication does not approve an Action, authorize a payment, or grant unrelated scopes.

Last modified on September 22, 2026