{"name":"Walmart Canada — sign your agent in","summary":"Sign in to Walmart Canada on behalf of your user with OAuth 2.0 Authorization Code + PKCE through LoginID AIGW. You register yourself as an OAuth client, the user approves you on LoginID, and Walmart Canada's callback finishes the sign-in. Never ask the user for their password and never type it into this page's password form.","callback_url":"https://walmart.testnet.loginid.io/agent/callback","discovery_url":"https://api.aigw.eval.loginid.ai/LAACHFN183HBEEO5L02J3BVQ/.well-known/openid-configuration","registration_endpoint":"https://api.aigw.eval.loginid.ai/api/register","authorization_endpoint":"https://api.aigw.eval.loginid.ai/LAACHFN183HBEEO5L02J3BVQ/oauth2/auth","scope":"openid profile email offline_access","steps":["1. Generate a PKCE code_verifier (43-128 chars of [A-Za-z0-9-._~]) and its S256 code_challenge, plus a random state and nonce (each at least 16 chars). Use fresh values for every attempt.","2. Register yourself with dynamic client registration: POST https://api.aigw.eval.loginid.ai/api/register with JSON {\"client_name\": \"<your agent name>\", \"redirect_uris\": [\"https://walmart.testnet.loginid.io/agent/callback\"], \"grant_types\": [\"authorization_code\", \"refresh_token\"], \"response_types\": [\"code\"], \"token_endpoint_auth_method\": \"none\", \"scope\": \"openid profile email offline_access\"}. The redirect URI must be exactly https://walmart.testnet.loginid.io/agent/callback. Keep the client_id from the response. Browser agents: if you can run JavaScript in this page, send it with fetch() from here (the endpoint allows cross-origin requests and this page permits the connection). If you cannot send POST requests at all, use the parent-agent fallback below (parent_agent_fallback).","3. Hand the flow to Walmart Canada before you authorize. With WebMCP: call the tool \"begin_agent_signin\" on this page with {client_id, code_verifier, state, nonce, client_name}. Without WebMCP: use the \"Agent sign-in\" form on this page (form id \"agent-signin-form\", fields client_id, code_verifier, state, nonce, client_name). It is visually hidden from the user, so set the field values directly by name and submit the form (its button is \"Continue to LoginID\"). Either way it must happen in the same browser that will open the authorization URL. Walmart Canada's callback uses the code_verifier to exchange the authorization code, so the user is signed in here and not only in your own session.","4. Call the authorization API at https://api.aigw.eval.loginid.ai/LAACHFN183HBEEO5L02J3BVQ/oauth2/auth with response_type=code, client_id, redirect_uri=https://walmart.testnet.loginid.io/agent/callback, scope=openid profile email offline_access, state, nonce, code_challenge and code_challenge_method=S256. The form submits there for you. The WebMCP tool returns the same URL as authorization_url; navigate this tab to it. The user signs in and approves you on LoginID themselves; do not fill in their credentials.","5. LoginID redirects to https://walmart.testnet.loginid.io/agent/callback. Walmart Canada checks state, exchanges the code with your code_verifier, verifies the ID token and signs your agent in. You land back on the Walmart Canada home page, which then shows \"Your agent is signed in\". With WebMCP you can also call \"get_agent_signin_status\" (or GET /api/agent-signin/status) and check signed_in=true. If the page shows an error banner instead, start again from step 1."],"parent_agent_fallback":{"summary":"For a browser agent that cannot send HTTP POST requests: hand these commands to your orchestrating (parent) agent, which runs them with curl. The parent agent does steps 1-3 outside the browser; the browser agent then only opens one URL.","commands":[{"label":"1. Parent agent: generate fresh one-time values (CODE_VERIFIER, STATE, NONCE).","command":"CODE_VERIFIER=$(openssl rand -base64 48 | tr '+/' '-_' | tr -d '=\\n'); STATE=$(openssl rand -hex 16); NONCE=$(openssl rand -hex 16); echo \"$CODE_VERIFIER $STATE $NONCE\""},{"label":"2. Parent agent: dynamic client registration. Replace <AGENT_NAME>; keep client_id from the JSON response.","command":"curl -sS -X POST 'https://api.aigw.eval.loginid.ai/api/register' -H 'Content-Type: application/json' -d '{\"client_name\":\"<AGENT_NAME>\",\"redirect_uris\":[\"https://walmart.testnet.loginid.io/agent/callback\"],\"grant_types\":[\"authorization_code\",\"refresh_token\"],\"response_types\":[\"code\"],\"token_endpoint_auth_method\":\"none\",\"scope\":\"openid profile email offline_access\"}'"},{"label":"3. Parent agent: hand the flow to Walmart Canada. Replace <CLIENT_ID>, <CODE_VERIFIER>, <STATE>, <NONCE>, <AGENT_NAME>.","command":"curl -sS -X POST 'https://walmart.testnet.loginid.io/api/agent-signin/start' -H 'Content-Type: application/json' -d '{\"client_id\":\"<CLIENT_ID>\",\"code_verifier\":\"<CODE_VERIFIER>\",\"state\":\"<STATE>\",\"nonce\":\"<NONCE>\",\"client_name\":\"<AGENT_NAME>\"}'"}],"handoff":"4. The step-3 response contains open_in_browser. The parent agent must pass that URL back to the browser agent. Walmart Canada's sign-in cookie is HttpOnly, so it cannot be copied into the browser by hand: instead the browser agent opens open_in_browser in the browser that will finish sign-in, which sets the cookie for that browser and forwards to LoginID. Do not open it with curl. It is single use and expires in 2 minutes. The user then approves on LoginID and the browser returns to Walmart Canada signed in (step 5)."},"rules":["Only S256 PKCE is accepted; never use code_challenge_method=plain.","state, nonce and code_verifier are one-time values. A pending sign-in expires after 10 minutes.","If the callback reports an error, start again from step 1 with new values. Do not reuse the authorization code."],"webmcp_tools":["get_agent_signin_instructions","begin_agent_signin","get_agent_signin_status","sign_out_agent"],"http_api":{"start":"POST /api/agent-signin/start — application/json returns authorization_url (and open_in_browser for callers outside the browser); the on-page form (x-www-form-urlencoded) redirects to LoginID.","bind":"GET /agent/bind?t=… — the open_in_browser link: sets the sign-in cookie in this browser and forwards to LoginID (single use, 2 minutes)","status":"GET /api/agent-signin/status","sign_out":"POST /api/agent-signin/sign-out"}}