The integration point for identity is not a client widget. ARC resolves credentials into caller context at the runtime boundary, then uses that context when it constructs session data views and applies policy.
Recommended order
- Read Caller context so you know what
CallerInfocontains and what fails closed. - Read Session data and session views so you know which paths a caller can receive.
- Store durable per-user data through the session's
/user(and only use/spacewhen the runtime enables it for your blocklet scope). - Keep authorization in provider and runtime policy. Use AUP or Web Device only for presentation and path binding.
- When you need the protocol or SDK itself, follow DID Connect in ARC for the runtime seam, then link out to DID Connect upstream materials for protocol details.
What “integration” means in ARC
| Layer | Your job | Runtime job |
|---|---|---|
| Credentials | Do not invent alternate auth headers in UI messages | Resolve cookie / Bearer / access key into CallerInfo |
| Session view | Bind UI and logic to /user, /tmp, and declared mounts | Build SessionUserAFS for the resolved caller only |
| Membership | Do not trust client-selected instance roles | Overlay membership only when server supplies instance context |
| Storage | Mount or use DID Space through supported AFS paths | Enforce role prefixes, isolation, and write gates |
Practical rules
- Prefer session paths over reconstructing
spaces/<did>/blocklets/...in application code. - Prefer server-resolved caller fields over form fields that “look like” a DID.
- Prefer local blocklet runs for UI acceptance; use isolated
arc space --root-pathfor offline data inspection (Inspect local spaces). - Do not package historical DID Connect admin UIs as the ARC-stable extension surface for new work.
Not covered here
End-to-end passkey onboarding screens, OAuth provider configuration, remote multi-tenant provisioning, and membership administration APIs need their own versioned contracts and examples. This section stops at the verified handoff that current source implements.