> ## Documentation Index
> Fetch the complete documentation index at: https://docs.agentcard.com/llms.txt
> Use this file to discover all available pages before exploring further.

# DoorDash

> Build a DoorDash cookie map, connect the account, and refresh its session.

DoorDash connects from a session your integration already holds. Creation, status checks, refresh, and disconnect follow the [Quickstart](https://docs.agentcard.com/commerce-sdk/connections/quickstart.md). Build the DoorDash session you send with the cookie map below.

> [!NOTE]
>
> Agentcard enables DoorDash connections for your app only where you have DoorDash's authorization to use its accounts this way. Agentcard never receives or stores the user's DoorDash password.

## Build the session object

For DoorDash, `session` is a JSON map of the cookies that make up the user's signed-in DoorDash session, as cookie name to value. Send every cookie the signed-in session holds. Agentcard requires all three cookies below before checking the session with DoorDash:

| Cookie | What it is |
| - | - |
| `dd_cx_logged_in` | `"true"` on a signed-in session. |
| `ajs_user_id` | The user's DoorDash consumer id. Agentcard reads it as the account reference. |
| `csrf_token` | Required for cart and checkout calls. Agentcard refuses a session without it. |

Agentcard refuses a session missing any of the three cookies. A `POST /buy/v2/connections` request with an incomplete session returns HTTP `400`:

```text title="Response · invalid session" theme={null}
{"error":"session_invalid","retryable":false}
```

Retry the create request below with all cookies from the same signed-in session. Live verification checks authenticated access; it does not independently confirm the account identifier in `ajs_user_id`.

## Create a DoorDash connection

```bash title="Request · create a DoorDash connection" theme={null}
curl -X POST https://api.agentcard.sh/buy/v2/connections \
  -H "Authorization: Bearer $ORG_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "user_id":  "usr_7g8h9i",
    "merchant": "doordash",
    "session": {
      "dd_cx_logged_in": "true",
      "ajs_user_id":     "\"3e9c…\"",
      "csrf_token":      "…",
      "cf_clearance":    "…"
    }
  }'
```

```json title="Response · 200 linked" theme={null}
{
  "object": "connection",
  "connection_id": "cxn_2b4d6f",
  "merchant": "doordash",
  "status": "linked",
  "last_verified_at": "2026-11-05T00:12:00Z"
}
```

Agentcard stores the session for your user and app immediately after DoorDash accepts it. The user does not open a consent page or enter a verification code for this company-supplied session. Your app can now use the stored connection to shop. See the [Quickstart](https://docs.agentcard.com/commerce-sdk/connections/quickstart.md) for status checks, refresh, and disconnect.

## Protect and refresh cookies

You supply the session from the authorized integration your company runs against DoorDash. Agentcard validates the session against DoorDash before storing it and encrypts it at rest under a key separate from card data. Agentcard never writes the session to logs or returns it through the API. Agentcard records an expiry of two weeks for an imported session, but DoorDash can revoke it earlier. Post a fresher session to the same endpoint to refresh it in place.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.