Agent Web Identity Sign-In

What This Is

Internet Identity (II) supports a CLI-auth flow that issues a delegation for a session key held outside the browser. icp identity link web uses it to let a terminal session — including an AI agent such as Claude Code — sign canister calls as the user's app-specific principal: the same principal the user has when signed in to that app's web UI (selected with --app <domain>).

The user still authenticates interactively in their own browser with their passkey; the agent only ends up holding a time-limited delegation. The private key of the user's II identity is never exposed.

Prerequisites