Logging in

Logging in

DoorDash redirects to a port nothing is listening on, so the browser shows "connection refused". That is expected — the URL in the address bar is the payload.

1. Start. Nothing is stored server-side; the pending login travels with you inside login_ticket.

curl -sX POST http://localhost:8787/v1/auth/login/start

{
  "authorize_url": "https://identity.doordash.com/authorize?...",
  "login_ticket": "ddl1.…",
  "redirect_uri": "http://localhost:4180/oauth2/callback",
  "expires_in": 600
}

2. Open authorize_url in a browser and sign in. You land on http://localhost:4180/oauth2/callback?code=…&state=… and the page fails to load. Copy the whole URL.

3. Finish. The state is checked against the ticket, then the code is redeemed with the PKCE verifier.

curl -sX POST http://localhost:8787/v1/auth/login/complete \
  -H 'content-type: application/json' \
  -d '{"login_ticket":"ddl1.…","redirect_url":"http://localhost:4180/oauth2/callback?code=…&state=…"}'

You get a session_token back, and a dd_session cookie is set. If you would rather parse the URL yourself, send {"code":…,"state":…} instead.

That is the last login you need until the session's hard expiry, 30 days later by default — the tokens renew themselves in between.