skills.rest
phukrit7171
phukrit7171COMMUNITY
Explore all skills by this author →
𝕏@Phukrit7171GitHub

agent-web-identity

Links an AI agent session to Internet Identity for authorized canister calls as the user's app principal.

Updated Apr 3, 2026
Search Tags:#authentication#delegation#internet identity#principal#icp cli#canister calls#agent sign-in
One-click install
npx skills add https://github.com/phukrit7171/Relationship-Smart-Contract-ICP --skill agent-web-identity-phukrit7171
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: agent-web-identity
Source: https://github.com/phukrit7171/Relationship-Smart-Contract-ICP/tree/main/.agents/skills/agent-web-identity
Command: npx skills add https://github.com/phukrit7171/Relationship-Smart-Contract-ICP --skill agent-web-identity-phukrit7171

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? AI agents and CLI sessions cannot normally sign in to Internet Identity-powered apps, so they cannot make authorized canister calls on a user's behalf. This Skill guides an agent through the icp identity link web flow to obtain a time-limited delegation for the user's app-specific principal without ever exposing the user's private key. ## Core Features & Use Cases - CLI-based II sign-in: Runs the icp identity link web flow in the background, handles the Enter prompt, relays the sign-in URL, and confirms identity creation. - App-specific principal targeting: Uses --app <domain> (e.g. oisy.com, nns.ic0.app) so the delegation matches the principal the user has in that app's web UI. - Pitfall avoidance and verification: Covers first-run CLI access enablement, expired delegation reauth, per-session identity naming, and verification via the public whoami canister. - Use Case: A user asks their AI agent to check their balance on oisy.com; the agent creates a fresh identity, the user signs in once in their browser, and the agent makes authenticated canister calls as the user's oisy principal. ## Quick Start Ask the agent to sign you in to an Internet Identity app such as oisy.com so it can make authorized canister calls on your behalf.

Frequently Asked Questions about agent-web-identity

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I let an AI agent sign in to Internet Identity?▼

Run `icp identity link web <NAME> --app <domain>` in the background with a newline piped to stdin, then have the user complete passkey sign-in in their browser. The agent receives a time-limited delegation for the user's app-specific principal without accessing the private key.

How do I make authorized canister calls as my app principal from the CLI?▼

After linking, pass `--identity <NAME>` explicitly on every `icp canister call`, and always include explicit arguments such as '()' for zero-argument methods. Verify the principal matches the app by calling the public whoami canister ivcos-eqaaa-aaaab-qablq-cai.

Can I use icp identity link web from a remote server or CI environment?▼

No. The flow delivers the delegation through a localhost callback, so the agent and the user's browser must be on the same machine. It does not work in containers, CI pipelines, or remote headless sessions.

Why does icp identity link web hang on Press Enter to log in?▼

On icp CLI 0.3.x the command blocks reading stdin before starting the flow, and a bare EOF from /dev/null does not satisfy the prompt. Pipe an actual newline with `printf '\n' |` so the flow starts on the first attempt.

What should I do when the delegation expires?▼

When calls start failing with signature or expiry errors, run `icp identity reauth <NAME>` and have the user sign in again as the same identity. The delegation lifetime is set by the identity provider and cannot be configured with a CLI flag.

Why does my linked identity show the wrong principal for the app?▼

The `--app` flag was likely omitted, so the provider used its default derivation origin. Pass the app's bare domain without scheme or path, such as `--app oisy.com`, to derive the same principal the user has in that app's web UI.

Related Skills

Explore More Software Engineering Skills→
Looping-AILooping-AI

internet-identity

Integrate Internet Identity passwordless authentication with passkey and OpenID login flows.

Official
Advanced
Looping-AILooping-AI

multi-canister

Coordinate and deploy multi-canister DApps across ICP canisters.

Official
Advanced
microsoftmicrosoft
2.9k

azure-identity-py

Authenticate Python applications to Azure services using DefaultAzureCredential.

Official
Intermediate
AlphaBitCoreAlphaBitCore
21

test-openai-responses

Automate end-to-end testing of the OpenAI Responses-API ingress via the local AI Gateway.

Official
Advanced