Overview

most useful browser workflows begin behind a login. KERNEL gives you two ways to authenticate browser agents without returning stored sensitive values through the api or putting them in your agent prompt: control the workflow yourself and Fill from Vault, or delegate the login and session lifecycle to Managed Auth. Fill from Vault is the recommended approach if you require greater visibility and control over the authentication experience, while Managed Auth is preferred if you would like KERNEL to handle the login lifecycle on your behalf.

​

Choose an auth approach

​

Common use cases

​

Use Fill from Vault

• an authentication prompt can appear in the middle of a longer workflow, in the same browser session.
• your product needs to control when and how it asks for credentials.
• your application or agent must own navigation, submission, and recovery.

one common use case is an ai assistant doing work on behalf of an end user. with Fill from Vault, the agent can login as the user to complete tasks on gated websites. your application or agent controls credential collection and completes the login in its current browser session.

​

Use Managed Auth

• the automation runs unattended or signs in repeatedly.
• you want KERNEL to navigate common login, sso, and mfa flows.
• you want health checks and eligible automatic reauthentication.

one common use case is recurring website qa on a set of known sites. KERNEL handles the login flow and attempts eligible automatic recovery before the automation begins. the automation can start testing on websites without needing to login.

​

Understand the security boundary

KERNEL doesn’t return stored sensitive fields in api responses or add them to model context. the fill operation writes real values into the browser. Page scripts, extensions, developer tools, and an agent with unrestricted browser access can read them after fill. Use the narrowest browser permissions that your workflow supports, and only attach a vault to sessions authorized to use all of its items.

​

Reuse authenticated state

Profiles persist cookies and local storage between browser sessions. Managed Auth saves successful logins to a profile automatically. A workflow using Fill from Vault can also save the resulting browser state to a profile when it needs to reuse that session.

​

Next steps