DoorDash

DoorDash connects from a session your integration already holds. Creation, status checks, refresh, and disconnect follow the Quickstart. Build the DoorDash session you send with the cookie map below.

Agentcard enables DoorDash connections for your app only where you have DoorDash’s authorization to use its accounts this way. Agentcard never receives or stores the user’s DoorDash password.

Build the session object

For DoorDash, session is a JSON map of the cookies that make up the user’s signed-in DoorDash session, as cookie name to value. Send every cookie the signed-in session holds. Agentcard requires all three cookies below before checking the session with DoorDash:

Cookie	What it is
`dd_cx_logged_in`	`"true"` on a signed-in session.
`ajs_user_id`	The user’s DoorDash consumer id. Agentcard reads it as the account reference.
`csrf_token`	Required for cart and checkout calls. Agentcard refuses a session without it.

Agentcard refuses a session missing any of the three cookies. A POST /buy/v2/connections request with an incomplete session returns HTTP 400:

Response · invalid session

{"error":"session_invalid","retryable":false}

Retry the create request below with all cookies from the same signed-in session. Live verification checks authenticated access; it does not independently confirm the account identifier in ajs_user_id.

Create a DoorDash connection

Request · create a DoorDash connection

curl -X POST https://api.agentcard.sh/buy/v2/connections \
  -H "Authorization: Bearer $ORG_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "user_id":  "usr_7g8h9i",
    "merchant": "doordash",
    "session": {
      "dd_cx_logged_in": "true",
      "ajs_user_id":     "\"3e9c…\"",
      "csrf_token":      "…",
      "cf_clearance":    "…"
    }
  }'

Response · 200 linked

{
  "object": "connection",
  "connection_id": "cxn_2b4d6f",
  "merchant": "doordash",
  "status": "linked",
  "last_verified_at": "2026-11-05T00:12:00Z"
}

Agentcard stores the session for your user and app immediately after DoorDash accepts it. The user does not open a consent page or enter a verification code for this company-supplied session. Your app can now use the stored connection to shop. See the Quickstart for status checks, refresh, and disconnect.

Protect and refresh cookies

You supply the session from the authorized integration your company runs against DoorDash. Agentcard validates the session against DoorDash before storing it and encrypts it at rest under a key separate from card data. Agentcard never writes the session to logs or returns it through the API. Agentcard records an expiry of two weeks for an imported session, but DoorDash can revoke it earlier. Post a fresher session to the same endpoint to refresh it in place.

Getting started

Guides

Vault

Issuing

Commerce SDK

Partners

Build the session object

Create a DoorDash connection

Protect and refresh cookies

​Build the session object

​Create a DoorDash connection

​Protect and refresh cookies

Build the session object

Create a DoorDash connection

Protect and refresh cookies