Overview

Managed Auth creates and maintains authenticated browser sessions for your AI agents. Store credentials once, and Kernel can automatically reauthenticate supported login flows when needed. When you launch Kernel browsers with Managed Auth connections, your agent can start logged in and ready to go. Managed Auth is the delegated path: Kernel runs the login flow, reads the site’s response, and reauthenticates a connection when its session expires or breaks. Choose it when you want Kernel to solve and maintain authentication, and you don’t want to own login logic for every site your agents touch. Choose vaults with fill when you want control and visibility over the auth experience instead. You collect credentials from a human, and your agent decides when to navigate, which inputs to fill, when to submit, and how to interpret the result. Kernel writes the stored values into the inputs you select and returns a value-free outcome, so raw credentials never pass back to your agent. You maintain the login logic, and in return every step is yours to inspect and change.

How It Works

Create a Connection

A Managed Auth Connection attaches a domain’s authentication state to a browser profile so future browsers can reuse it. A single profile can have multiple auth connections, one per domain.

const auth = await kernel.auth.connections.create({
  domain: 'netflix.com',
  profile_name: 'netflix-user-123',
});

auth = await kernel.auth.connections.create(
    domain="netflix.com",
    profile_name="netflix-user-123",
)

auth, err := client.Auth.Connections.New(ctx, kernel.AuthConnectionNewParams{
	ManagedAuthCreateRequest: kernel.ManagedAuthCreateRequestParam{
		Domain:      "netflix.com",
		ProfileName: "netflix-user-123",
	},
})
if err != nil {
	panic(err)
}
_ = auth

Start a Login Session

A Managed Auth Session is the corresponding login flow for the specified connection. Users provide credentials via a Kernel-hosted page or your own UI.Specify a Credential to enable automatic reauthentication for supported credential-based flows.

const login = await kernel.auth.connections.login(auth.id);

// Send user to login page
console.log('Login URL:', login.hosted_url);

// Stream state changes until the flow completes
const events = await kernel.auth.connections.follow(auth.id);
let finalState;

for await (const event of events) {
  if (event.event === 'managed_auth_state') {
    finalState = event;
  }
}

if (finalState?.flow_status === 'SUCCESS') {
  console.log('Authenticated!');
}

login = await kernel.auth.connections.login(auth.id)

# Send user to login page
print(f"Login URL: {login.hosted_url}")

# Stream state changes until the flow completes
events = await kernel.auth.connections.follow(auth.id)
final_state = None

async for event in events:
    if event.event == "managed_auth_state":
        final_state = event

if final_state and final_state.flow_status == "SUCCESS":
    print("Authenticated!")

login, err := client.Auth.Connections.Login(ctx, auth.ID, kernel.AuthConnectionLoginParams{})
if err != nil {
	panic(err)
}

// Send user to login page
fmt.Println("Login URL:", login.HostedURL)

// Stream state changes until the flow completes
events := client.Auth.Connections.FollowStreaming(ctx, auth.ID)
authenticated := false

for events.Next() {
	event := events.Current()
	if event.Event == "managed_auth_state" && event.FlowStatus == "SUCCESS" {
		authenticated = true
	}
}
if err := events.Err(); err != nil {
	panic(err)
}

if authenticated {
	fmt.Println("Authenticated!")
}

Use the Profile

Once the auth connection completes, the authenticated session is saved to the browser profile specified in step 1. You can attach additional auth connections to the same profile for other domains. When you create a browser with the profile, it loads the saved authentication state for every connected domain.

const browser = await kernel.browsers.create({
  profile: { name: 'netflix-user-123' },
  stealth: true,
});

// Navigate with the saved authentication state
await page.goto('https://netflix.com');

browser = await kernel.browsers.create(
    profile={"name": "netflix-user-123"},
    stealth=True,
)

# Navigate with the saved authentication state
await page.goto("https://netflix.com")

browser, err := client.Browsers.New(ctx, kernel.BrowserNewParams{
	Profile: shared.BrowserProfileParam{
		Name: kernel.String("netflix-user-123"),
	},
	Stealth: kernel.Bool(true),
})
if err != nil {
	panic(err)
}
_ = browser

// Navigate with the saved authentication state
_, err = client.Browsers.Playwright.Execute(ctx, browser.SessionID, kernel.BrowserPlaywrightExecuteParams{
	Code: `await page.goto("https://netflix.com");`,
})
if err != nil {
	panic(err)
}

The steps above are the integration loop you wire up once per connection. After the initial login, Kernel monitors the connection with periodic health checks and can automatically reauthenticate eligible flows. See Connection Lifecycle for the runtime behavior and configuration options.

Choose Your Integration

Hosted UI

Start here - Simplest integrationRedirect users to Kernel’s hosted page. Add features incrementally: save credentials for eligible automatic reauthentication, set custom login URLs, and configure SSO.

React Component

Embed in your app - Drop-in componentMount <KernelManagedAuth /> on a route in your own app. Same flow as Hosted UI, rendered on your origin and trivial to restyle to match your brand.

Programmatic

Full control - Custom UI or headlessBuild your own credential collection. Handle login fields, SSO buttons, MFA selection, and external actions (push notifications, security keys).

Why Managed Auth?

Managed Auth runs login flows by navigating login pages, filling credentials, following SSO redirects, and guiding users through additional authentication steps. It saves the resulting session state to a reusable profile. The most valuable workflows live behind logins. Managed Auth provides:

Broad site coverage - Login pages are discovered and handled across common website login flows
SSO/OAuth support - Kernel follows common SSO redirects. Common provider domains are allowed by default; add custom provider domains to allowed_domains
2FA/OTP handling - Kernel attempts to provide TOTP codes automatically; interactive login can collect other verification steps
Post-login URL - Get the URL where login landed (post_login_url) so you can start automations from the right page
Session monitoring - Periodic health checks and automatic reauthentication for eligible credential-based flows
Secure by default - Credentials are encrypted at rest and never exposed in API responses or passed to LLMs

Security

Feature	Description
Encrypted credentials	Values encrypted with per-organization keys
No credential exposure	Never returned in API responses or passed to LLMs
Encrypted profiles	Browser session state encrypted end-to-end
Isolated execution	Each login runs in an isolated browser environment

Working with your browser

Integrations

Migrations

deploying your agent

Agent Skills

Community

Info

Overview

How It Works

Choose Your Integration

Hosted UI

React Component

Programmatic

Why Managed Auth?

Security

​How It Works

​Choose Your Integration

Hosted UI

React Component

Programmatic

​Why Managed Auth?

​Security

How It Works

Choose Your Integration

Why Managed Auth?

Security