`references/doordash.md`

45 lines
# DoorDash adapter — BLOCKED at bot-wall (first run 2026-08-02)

Status: first real run attempted 2026-08-02. `doordash.com` (home AND
`identity.doordash.com/auth`) serves a **Cloudflare Turnstile "Verify you are
human" interstitial** to the Playwright-launched real Chrome — it never reaches
the sign-in form (no email field; only "Cloudflare"/"Privacy" links render).
Direct nav to `/auth` errors ("Client ID cannot be null…") because the OAuth
params only get injected after passing the wall.

This is the automation-detection signature the `openclaw-real-chrome` skill
documents. Programmatic Turnstile clicks (iframe locator, coordinate click,
bounding-box click) were all tried and DID NOT clear it — do not keep hammering.
**Path forward:** drive DoorDash through `openclaw` (Steve's own real Chrome
profile, human fingerprint) OR a one-time manual human pass to seed the
persistent profile, after which the parked session should reconnect over CDP
like UberEats/Instacart. Both require Steve's go (openclaw needs explicit
authorization to use his real Chrome).

Selectors below remain UNVERIFIED (never reached the form).

## Expected auth flow

1. `https://www.doordash.com/` → Sign In → `identity.doordash.com`.
2. Email or phone entry → continue.
3. Gate types to expect (verify): email OTP, SMS OTP. DoorDash is known to
   bot-wall aggressively (PerimeterX family) — headed real Chrome mandatory;
   if walled, the openclaw-real-chrome fallback pattern applies.
4. No card-digit gate reported for login (verify).

## After login

1. Live-order check: home page banner / Orders tab shows active orders.
   DoorDash DOES allow address change on an active order in some windows via
   order Help → "Change address" (verify availability per order state).
2. Address book: Account → Addresses (`/account/addresses`) → Add Address —
   search field autocompletes; entering a verbatim street+zip then selecting
   the exact match satisfies the verbatim rule. Supports apt/suite + drop-off
   instructions + pin adjust.

## Quirks (to confirm on first run)

- Persistent-context profile reuse may keep the session alive for weeks —
  prefer reusing the profile before re-running login gates.
- CDP port suggestion: 9224 (keep one port per provider).