> ## Documentation Index
> Fetch the complete documentation index at: https://darwin.so/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# OAuth authentication

> Authorize provider scopes through a first-party browser flow.

OAuth lets a user authorize provider access without putting authorization URLs, codes, access tokens, or refresh tokens in an AI conversation. The resulting authorization is represented as a `connection` in the API.

## Complete the browser step

When OAuth is required, the planned Authenticate operation returns a first-party `webLink`. Darwin validates the current interaction and Action revision before starting the provider flow.

```text theme={null}
connection_required -> first-party Darwin page -> provider authorization
                    -> verified callback -> same Action resumes
```

Requested scopes cannot exceed the bound authentication interaction. If the provider or scope set changes, Darwin requires a new authorization.

## Choose retention explicitly

The user can authorize the connection for this Action only or explicitly save the resulting credential in [Darwin Vault](/docs/act/darwin-vault). Provider authentication does not approve an Action, authorize a payment, or grant unrelated scopes.