> ## Documentation Index
> Fetch the complete documentation index at: https://tbd-6fc993ce-hypeship-docs-ia-restructure.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.
# Overview
> Maintain authenticated browser sessions for agents
Managed Auth creates and maintains authenticated browser sessions for your AI agents. Store credentials once, and Kernel can automatically reauthenticate supported login flows when needed. When you launch Kernel browsers with Managed Auth connections, your agent can start logged in and ready to go.
## How It Works
A **Managed Auth Connection** attaches a domain's authentication state to a browser [profile](/auth/profiles) so future browsers can reuse it. A single profile can have multiple auth connections, one per domain.
```typescript TypeScript theme={null}
const auth = await kernel.auth.connections.create({
domain: 'netflix.com',
profile_name: 'netflix-user-123',
});
```
```python Python theme={null}
auth = await kernel.auth.connections.create(
domain="netflix.com",
profile_name="netflix-user-123",
)
```
```go Go theme={null}
auth, err := client.Auth.Connections.New(ctx, kernel.AuthConnectionNewParams{
ManagedAuthCreateRequest: kernel.ManagedAuthCreateRequestParam{
Domain: "netflix.com",
ProfileName: "netflix-user-123",
},
})
if err != nil {
panic(err)
}
_ = auth
```
A **Managed Auth Session** is the corresponding login flow for the specified connection. Users provide credentials via a Kernel-hosted page or your own UI.
Specify a [Credential](/auth/credentials) to enable automatic reauthentication for supported credential-based flows.
```typescript TypeScript theme={null}
const login = await kernel.auth.connections.login(auth.id);
// Send user to login page
console.log('Login URL:', login.hosted_url);
// Stream state changes until the flow completes
const events = await kernel.auth.connections.follow(auth.id);
let finalState;
for await (const event of events) {
if (event.event === 'managed_auth_state') {
finalState = event;
}
}
if (finalState?.flow_status === 'SUCCESS') {
console.log('Authenticated!');
}
```
```python Python theme={null}
login = await kernel.auth.connections.login(auth.id)
# Send user to login page
print(f"Login URL: {login.hosted_url}")
# Stream state changes until the flow completes
events = await kernel.auth.connections.follow(auth.id)
final_state = None
async for event in events:
if event.event == "managed_auth_state":
final_state = event
if final_state and final_state.flow_status == "SUCCESS":
print("Authenticated!")
```
```go Go theme={null}
login, err := client.Auth.Connections.Login(ctx, auth.ID, kernel.AuthConnectionLoginParams{})
if err != nil {
panic(err)
}
// Send user to login page
fmt.Println("Login URL:", login.HostedURL)
// Stream state changes until the flow completes
events := client.Auth.Connections.FollowStreaming(ctx, auth.ID)
authenticated := false
for events.Next() {
event := events.Current()
if event.Event == "managed_auth_state" && event.FlowStatus == "SUCCESS" {
authenticated = true
}
}
if err := events.Err(); err != nil {
panic(err)
}
if authenticated {
fmt.Println("Authenticated!")
}
```
Once the auth connection completes, the authenticated session is saved to the browser [profile](/auth/profiles) specified in step 1. You can attach additional auth connections to the same profile for other domains. When you create a browser with the profile, it loads the saved authentication state for every connected domain.
```typescript TypeScript theme={null}
const browser = await kernel.browsers.create({
profile: { name: 'netflix-user-123' },
stealth: true,
});
// Navigate with the saved authentication state
await page.goto('https://netflix.com');
```
```python Python theme={null}
browser = await kernel.browsers.create(
profile={"name": "netflix-user-123"},
stealth=True,
)
# Navigate with the saved authentication state
await page.goto("https://netflix.com")
```
```go Go theme={null}
browser, err := client.Browsers.New(ctx, kernel.BrowserNewParams{
Profile: shared.BrowserProfileParam{
Name: kernel.String("netflix-user-123"),
},
Stealth: kernel.Bool(true),
})
if err != nil {
panic(err)
}
_ = browser
// Navigate with the saved authentication state
_, err = client.Browsers.Playwright.Execute(ctx, browser.SessionID, kernel.BrowserPlaywrightExecuteParams{
Code: `await page.goto("https://netflix.com");`,
})
if err != nil {
panic(err)
}
```
The steps above are the integration loop you wire up once per connection. After the initial login, Kernel monitors the connection with periodic health checks and can automatically reauthenticate eligible flows. See [Connection Lifecycle](/auth/connection-lifecycle) for the runtime behavior and configuration options.
## Choose Your Integration
**Start here** - Simplest integration
Redirect users to Kernel's hosted page. Add features incrementally: save credentials for eligible automatic reauthentication, set custom login URLs, and configure SSO.
**Embed in your app** - Drop-in component
Mount `` on a route in your own app. Same flow as Hosted UI, rendered on your origin and trivial to restyle to match your brand.
**Full control** - Custom UI or headless
Build your own credential collection. Handle login fields, SSO buttons, MFA selection, and external actions (push notifications, security keys).
## Why Managed Auth?
Managed Auth runs **login flows** by navigating login pages, filling credentials, following SSO redirects, and guiding users through additional authentication steps. It saves the resulting session state to a reusable profile.
The most valuable workflows live behind logins. Managed Auth provides:
* **Broad site coverage** - Login pages are discovered and handled across common website login flows
* **SSO/OAuth support** - Kernel follows common SSO redirects. Common provider domains are allowed by default; add custom provider domains to `allowed_domains`
* **2FA/OTP handling** - Kernel attempts to provide TOTP codes automatically; interactive login can collect other verification steps
* **Post-login URL** - Get the URL where login landed (`post_login_url`) so you can start automations from the right page
* **Session monitoring** - [Periodic health checks](/auth/connection-lifecycle) and automatic reauthentication for eligible credential-based flows
* **Secure by default** - Credentials are encrypted at rest and never exposed in API responses or passed to LLMs
## Security
| Feature | Description |
| -------------------------- | -------------------------------------------------- |
| **Encrypted credentials** | Values encrypted with per-organization keys |
| **No credential exposure** | Never returned in API responses or passed to LLMs |
| **Encrypted profiles** | Browser session state encrypted end-to-end |
| **Isolated execution** | Each login runs in an isolated browser environment |
## FAQ
### How does automatic re-authentication work?
When you link credentials to a connection, Kernel runs periodic health checks and can reauthenticate supported credential-based flows in the background. This includes TOTP when Kernel can provide the authenticator code. See [Connection Lifecycle](/auth/connection-lifecycle) for the full lifecycle, cadence options, and `can_reauth` rules.
### What are auth choices?
Auth choices are visible routes a site presents during login, including mfa methods, sso providers, account pickers, and organization selectors. They appear in the canonical `choices` array. Submit the exact returned id with `interaction_id` and `selected_choice_id`. See the [programmatic flow guide](/auth/programmatic#choices) for examples.
### Which authentication methods are supported?
Managed Auth supports common credential, SSO, and multi-step login flows. Automatic reauthentication uses stored credentials and attempts to provide TOTP codes when needed.
Passkey-only authentication isn't currently supported. If a site's SSO provider requires a passkey, the login returns `unsupported_auth_method`. Switch the account to a supported sign-in method, such as password and TOTP, then start a new login.
### What happens if login fails?
Kernel surfaces an error code (`credentials_invalid`, `account_locked`, `bot_detected`, `captcha_blocked`, etc.). Transient site failures are retried; a conclusive rejection by the site isn't, so Kernel doesn't burn attempts against a locked account or resubmit credentials the site already refused. See [Connection Lifecycle](/auth/connection-lifecycle#when-a-login-fails) for the full list and recovery steps.
### Can I use Managed Auth with any website?
Managed Auth covers common login flows across a broad range of websites. Site-specific authentication and bot detection can require additional configuration. See [what Managed Auth supports](/auth/overview#why-managed-auth) and test your target flow.
### Is Managed Auth available during a trial?
Yes. Managed Auth and browser profiles are available during your trial period with the same capabilities as the plan you're trialing.
### How do I re-authenticate a connection before the next health check?
Call `.login()` on the connection to trigger auth immediately. See [Triggering re-auth manually](/auth/connection-lifecycle#triggering-re-auth-manually) for the pattern.
### What types of flows does Managed Auth support?
Managed Auth navigates login pages, enters stored credentials, follows SSO redirects, guides users through additional authentication steps, and saves the resulting browser session. For post-login work like form filling, sign-ups, or other workflows, use [Kernel's browser automation](/introduction/control) directly.
### How do I debug a managed auth session?
Use the **Browser Sessions** tab in the dashboard for live view, or set `record_session: true` to capture replays of every auth browser session. See [Debugging a flaky connection](/auth/connection-lifecycle#debugging-a-flaky-connection) for details.
### Can I attach multiple auth connections to one profile?
Yes. A profile can have any number of auth connections, each for a different domain. When you create a browser with that profile, it loads the saved authentication state for every connected domain.
This is useful for two common patterns:
* **Multi-site workflows** — Your agent visits multiple sites in a single run (e.g., reads email in Gmail, posts a summary in Slack, and updates a CRM). Attach one auth connection per site to a single profile, and each browser loads the saved authentication state for all of them.
* **User-to-profile mapping** — Each end user on your platform gets one profile. All of that user's accounts (Gmail, LinkedIn, GitHub, etc.) are auth connections on their profile. When the user triggers a workflow, launch a browser with their profile.
See [Profiles — Multiple auth connections per profile](/auth/profiles#multiple-auth-connections-per-profile) for code examples.
### How is Managed Auth billed?
Managed Auth is included on all plans with no per-connection fees. It uses browser sessions for login, health checks, and eligible reauthentication attempts. These count toward your browser usage like any other browser session.
Auth sessions are fast (typically 5-30 seconds each). Kernel monitors session health and can automatically reauthenticate eligible credential-based flows when sessions expire. Most sessions stay valid for days. For example, monitoring 100 auth connections typically costs less than \$5/month in browser usage. See [Pricing & Limits](/info/pricing#managed-auth) for details.