Let an agent sign in without seeing the password

Browz can sign an AI agent in with a password and an authenticator (2FA) code you stored, and the agent never sees either. The agent points at a field, and Browz types the value itself, only on the sites you allowed for that sign-in and only into a real password field (a code may also go into a one-time-code field). Until the page changes, Browz pauses script, screenshots and waiting for page text for the agent in that profile, and every fill is recorded in your local action log without the value.

You manage keys and stored sign-ins in the Browz app, under Automate (Agent keys and Saved sign-ins), or from the command line (browz agent-token and browz credential). The browz command is built into the agent, at Browz.app, Contents, Resources, browz-agent.

1. Store the sign-in: browz credential add --label "Shop (Jane)" --username [email protected] --site shop.example.com --profile followed by the profile id. Add --totp to store the seed for authenticator codes too. Browz asks for the password and the seed with a hidden prompt; secrets are never taken from the command line.
2. Name the narrowest site that works. A bare domain such as example.com allows that domain and its subdomains over https. To allow one host only, give its full origin, with the scheme in front and a port if it is not 443: that allows exactly that host and port.
3. Choose who may use it: --profile with one profile id, --group with a profile group id, or --any.
4. Ask the agent to sign in. It lists the stored sign-ins, which shows labels, masked usernames and sites but never a secret, finds the fields in a snapshot, and asks Browz to fill each one. It is told only that the field was filled. Browz works out a code at that moment from the seed.
5. If the agent has its own key, the key needs the browz:credentials:use scope, and it can use a sign-in only in its own profiles and on its allowed sites. A key can never add, change or remove a sign-in.
6. Manage them with browz credential list, browz credential update followed by the id and --password to change the password, and browz credential remove followed by the id.

Browz checks every fill itself, whatever the agent asks for. The page, and every frame around the field, must be on one of the sign-in's sites over https. A password goes only into a password field, and a code only into a password field or a field marked for one-time codes. Each sign-in can be filled 12 times in any 10 minutes. A sign-in page whose code box is a plain text field is refused, and the agent should hand that step to you.

Until the page changes, Browz pauses script, screenshots and waiting for page text for the agent in that profile, and snapshots show the filled field as redacted. Every fill, refused ones included, is in your local action log without the value.

Store sign-ins only for sites you trust with them: a page that copies or transforms a password it was given can expose it. If the Browz agent restarts, it closes the profile’s browser before it answers any request, so a filled page is never open to an agent without this protection.

A key governs what an agent does through Browz. Programs that run as the same computer user as Browz can read its data folder, so run an agent you do not trust under another user or in a container.

Stored sign-ins are for accounts you are entitled to use. The acceptable use policy applies to AI agents the same as to people. Stored sign-ins are used through the local MCP server on your computer.

Give an AI agent its own key →

Automation basics →

Still stuck? Export diagnostics and contact support.