Overview

most useful browser workflows begin behind a login. KERNEL provides the building blocks for authenticating browser agents, not a single fixed login flow. you decide how much of the experience your application owns, from where end users enter credentials to who drives the login and when it runs again. stored sensitive values are never returned through the api or put in your agent prompt, whichever blocks you use. the blocks fall into two approaches: control the workflow yourself with Fill from Vault, or delegate the login and session lifecycle to Managed Auth. Fill from Vault is the recommended approach if you require greater visibility and control over the authentication experience, while Managed Auth is preferred if you would like KERNEL to handle the login lifecycle on your behalf.

​

Building blocks

pick the blocks that match the experience you want your end users to have. they can be used on their own or combined.

​

Choose an auth approach

​

Common use cases

​

Use Fill from Vault

• an authentication prompt can appear in the middle of a longer workflow, in the same browser session.
• your product needs to control when and how it asks for credentials.
• your application or agent must own navigation, submission, and recovery.

one common use case is an ai assistant doing work on behalf of an end user. with Fill from Vault, the agent can login as the user to complete tasks on gated websites. your application or agent controls credential collection and completes the login in its current browser session.

​

Use Managed Auth

• the automation runs unattended or signs in repeatedly.
• you want KERNEL to navigate common login, sso, and mfa flows.
• you want health checks and eligible automatic reauthentication.

one common use case is recurring website qa on a set of known sites. KERNEL handles the login flow and attempts eligible automatic recovery before the automation begins. the automation can start testing on websites without needing to login.

​

Understand the security boundary

KERNEL doesn’t return stored sensitive fields in api responses or add them to model context. the fill operation writes real values into the browser. Page scripts, extensions, developer tools, and an agent with unrestricted browser access can read them after fill. Use the narrowest browser permissions that your workflow supports, and only attach a vault to sessions authorized to use all of its items.

​

Reuse authenticated state

Profiles persist cookies and local storage between browser sessions. Managed Auth saves successful logins to a profile automatically. A workflow using Fill from Vault can also save the resulting browser state to a profile when it needs to reuse that session.

​

Next steps