FAQ

How does automatic re-authentication work?

When you link credentials to a connection, Kernel runs periodic health checks, detects logged-out sessions, and re-authenticates in the background so the profile stays logged in. See Health Checks for the full lifecycle, cadence options, and can_reauth rules.

What are sign-in options?

Sign-in options are non-MFA choices that some sites present during login, such as account pickers (“Which account do you want to use?”) or organization selectors. Unlike MFA options which are security challenges, sign-in options are informational choices that route the login flow. They appear in the session state as sign_in_options and are submitted via sign_in_option_id. See the Programmatic flow guide for details and SDK examples.

Which authentication methods are supported?

Managed Auth supports username/password authentication and most SSO providers.

Passkey-based authentication (e.g., Google accounts with passkeys enabled) is not currently supported. If a user’s SSO provider requires a passkey, the login will fail with the unsupported_auth_method error code.

What happens if login fails?

Kernel retries with exponential backoff, then surfaces an error code (credentials_invalid, bot_detected, captcha_blocked, etc.). See Health Checks for the full list and recovery steps.

Can I use Managed Auth with any website?

Managed Auth works with most websites. Sites with aggressive bot detection may require additional configuration (stealth mode, proxies). Passkeys and hardware security keys are not currently supported.

Is Managed Auth available during a trial?

Yes. Managed Auth and browser profiles are available during your trial period with the same capabilities as the plan you’re trialing.

How do I re-authenticate a connection before the next health check?

Call .login() on the connection to trigger auth immediately. See Triggering re-auth manually for the pattern.

What types of flows does Managed Auth support?

Managed Auth handles login and authentication flows end-to-end: entering credentials, multi-step login forms (e.g. email on one page, password on the next), SSO redirects, MFA challenges, and keeping sessions alive. For post-login browser work like form filling, sign-ups, or other workflows, use Kernel’s browser automation directly.

How do I debug a managed auth session?

Use the Browser Sessions tab in the dashboard for live view, or set record_session: true to capture replays of every auth browser session. See Debugging a flaky connection for details.

Can I attach multiple auth connections to one profile?

Yes. A profile can have any number of auth connections, each for a different domain. When you create a browser with that profile, it is already logged in to every connected domain.

This is useful for two common patterns:

• Multi-site workflows — Your agent visits multiple sites in a single run (e.g., reads email in Gmail, posts a summary in Slack, and updates a CRM). Attach one auth connection per site to a single profile, and the browser starts logged in to all of them.
• User-to-profile mapping — Each end user on your platform gets one profile. All of that user’s accounts (Gmail, LinkedIn, GitHub, etc.) are auth connections on their profile. When the user triggers a workflow, launch a browser with their profile.

See Profiles — Multiple auth connections per profile for code examples.

How is Managed Auth billed?

Managed Auth is included on all paid plans with no per-connection fees. It uses browser sessions to log in and keep your sessions fresh—these count toward your browser usage like any other browser session.

Auth sessions are fast (typically 5-30 seconds each). Kernel monitors session health and re-authenticates automatically when sessions expire—most stay valid for days. For example, keeping 100 auth connections logged in typically costs less than $5/month in browser usage. See Pricing & Limits for details.