1
Register and verify
You do not need to open the Darwin web app or create a key first.Darwin returns an unverified account and a Success: the one-time email link marks the account as verified. The registration response’s
nextStep; it does not silently create an agent, application, or credential.Request the verification email, then open its one-time link. Email ownership is the one out-of-band step; everything after it can stay in HTTP.nextStep remains the authoritative instruction.2
Start a session and finish the profile
Sign in with the password from registration and keep the returned secure session cookie in a temporary cookie jar.For a
business or software account, include organizationName and organizationDomain in the profile request. A phone number is optional until an operation explicitly requires it.Success: the profile request returns 200. If you are building an app, continue with Developers.Approve an app when you need Act
When a product you use needs to Act, sign up or sign in through Darwin and review its requested OAuth access. You return to the product after consent. The product does not get your password, session cookie, or an API key. You can revoke the connection. An approvedhuman:actions grant authorizes your account, not every target or effect; Darwin still checks route readiness and any separate provider, action, or payment request.
The developer cannot silently create a verified account and act as you. Account creation alone does not grant consent. Provider connections, action approvals, and payments may still require their own explicit steps.
Choose the narrowest path
Browse Search
Use an API key or scoped OAuth access token with
directory:read for Search. You can explore the website as a guest.AI client or coding agent
Complete Darwin sign-in and scoped consent before connecting to MCP or calling any tool.
Browse with an agent
Use your account-level OAuth grant for a verified, executable route. Do not treat a Search result as completed work.
Building a product
Register an application and create a server-side Search key. Customer actions require that customer’s own consent.