For AI agents: sign in on your user's behalf

If your user asked you to sign them in to Walmart Canada, follow these steps. Never ask for or type the user's password; they approve you on LoginID themselves. WebMCP tools on this page do the same thing (begin_agent_signin). The machine-readable version, including ready-made curl commands, is at /.well-known/agent-signin.json.

Callback (redirect_uri)

https://walmart.testnet.loginid.io/agent/callback

Scope

openid profile email offline_access

1. 1. Generate a PKCE code_verifier (43-128 chars of [A-Za-z0-9-._~]) and its S256 code_challenge, plus a random state and nonce (each at least 16 chars). Use fresh values for every attempt.
2. 2. Register yourself with dynamic client registration: POST https://api.aigw.eval.loginid.ai/api/register with JSON {"client_name": "<your agent name>", "redirect_uris": ["https://walmart.testnet.loginid.io/agent/callback"], "grant_types": ["authorization_code", "refresh_token"], "response_types": ["code"], "token_endpoint_auth_method": "none", "scope": "openid profile email offline_access"}. The redirect URI must be exactly https://walmart.testnet.loginid.io/agent/callback. Keep the client_id from the response. Browser agents: if you can run JavaScript in this page, send it with fetch() from here (the endpoint allows cross-origin requests and this page permits the connection). If you cannot send POST requests at all, use the parent-agent fallback below (parent_agent_fallback).
3. 3. Hand the flow to Walmart Canada before you authorize. With WebMCP: call the tool "begin_agent_signin" on this page with {client_id, code_verifier, state, nonce, client_name}. Without WebMCP: use the "Agent sign-in" form on this page (form id "agent-signin-form", fields client_id, code_verifier, state, nonce, client_name). It is visually hidden from the user, so set the field values directly by name and submit the form (its button is "Continue to LoginID"). Either way it must happen in the same browser that will open the authorization URL. Walmart Canada's callback uses the code_verifier to exchange the authorization code, so the user is signed in here and not only in your own session.
4. 4. Call the authorization API at https://api.aigw.eval.loginid.ai/LAACHFN183HBEEO5L02J3BVQ/oauth2/auth with response_type=code, client_id, redirect_uri=https://walmart.testnet.loginid.io/agent/callback, scope=openid profile email offline_access, state, nonce, code_challenge and code_challenge_method=S256. The form submits there for you. The WebMCP tool returns the same URL as authorization_url; navigate this tab to it. The user signs in and approves you on LoginID themselves; do not fill in their credentials.
5. 5. LoginID redirects to https://walmart.testnet.loginid.io/agent/callback. Walmart Canada checks state, exchanges the code with your code_verifier, verifies the ID token and signs your agent in. You land back on the Walmart Canada home page, which then shows "Your agent is signed in". With WebMCP you can also call "get_agent_signin_status" (or GET /api/agent-signin/status) and check signed_in=true. If the page shows an error banner instead, start again from step 1.

If you are a browser agent and cannot send HTTP POST requests

Hand these commands to your orchestrating (parent) agent, which can run curl. Fill in the <PLACEHOLDERS> and run them in order:

1. 1. Parent agent: generate fresh one-time values (CODE_VERIFIER, STATE, NONCE).

   CODE_VERIFIER=$(openssl rand -base64 48 | tr '+/' '-_' | tr -d '=\n'); STATE=$(openssl rand -hex 16); NONCE=$(openssl rand -hex 16); echo "$CODE_VERIFIER $STATE $NONCE"

2. 2. Parent agent: dynamic client registration. Replace <AGENT_NAME>; keep client_id from the JSON response.

   curl -sS -X POST 'https://api.aigw.eval.loginid.ai/api/register' -H 'Content-Type: application/json' -d '{"client_name":"<AGENT_NAME>","redirect_uris":["https://walmart.testnet.loginid.io/agent/callback"],"grant_types":["authorization_code","refresh_token"],"response_types":["code"],"token_endpoint_auth_method":"none","scope":"openid profile email offline_access"}'

3. 3. Parent agent: hand the flow to Walmart Canada. Replace <CLIENT_ID>, <CODE_VERIFIER>, <STATE>, <NONCE>, <AGENT_NAME>.

   curl -sS -X POST 'https://walmart.testnet.loginid.io/api/agent-signin/start' -H 'Content-Type: application/json' -d '{"client_id":"<CLIENT_ID>","code_verifier":"<CODE_VERIFIER>","state":"<STATE>","nonce":"<NONCE>","client_name":"<AGENT_NAME>"}'

4. The step-3 response contains open_in_browser. The parent agent must pass that URL back to the browser agent. Walmart Canada's sign-in cookie is HttpOnly, so it cannot be copied into the browser by hand: instead the browser agent opens open_in_browser in the browser that will finish sign-in, which sets the cookie for that browser and forwards to LoginID. Do not open it with curl. It is single use and expires in 2 minutes. The user then approves on LoginID and the browser returns to Walmart Canada signed in (step 5).