Create auth connection

Whether to permit automatic re-authentication when a scheduled health check detects an expired session. This is an opt-in flag only — it does not check whether re-auth is actually feasible. Even when true, re-auth only runs when the system has what it needs to perform it (for example, saved credentials for the required login fields), and only after a scheduled health check detects an expired session — so this flag has no effect when health_checks is false. When false, expired sessions are marked as NEEDS_AUTH instead of attempting re-auth. Defaults to true.

Domain for authentication

Interval in seconds between automatic health checks. When set, the system periodically verifies the authentication status and triggers re-authentication if needed. Maximum is 86400 (24 hours). Default is 3600 (1 hour) or your plan minimum, whichever is larger. The minimum depends on your plan: Enterprise: 300 (5 minutes), Startup: 1200 (20 minutes), Hobbyist: 3600 (1 hour), Free: 21600 (6 hours).

Whether to enable periodic health checks. When false, the system will not automatically verify authentication status, and auto_reauth has no effect on the automatic flow (since re-auth is only triggered by a failed scheduled health check). Defaults to true.

Whether a login blocked by a CAPTCHA the browser cannot solve pauses for a person instead of failing. The flow moves to AWAITING_HUMAN_INTERVENTION with a human_intervention choice; the person completes the challenge in live_view_url, then submits that choice to resume. Reauthentication never pauses. Defaults to false.

Optional login page URL to skip discovery

Name of the profile to manage authentication for. If the profile does not exist, it is created automatically.

Whether to record browser sessions for this connection by default. Useful for debugging. Can be overridden per-login. Defaults to false.

Whether to save credentials after every successful login. Defaults to true. One-time codes (TOTP, SMS, etc.) are not saved.

Whether automatic re-authentication is permitted for this connection. This is an opt-in flag only — it does not check whether re-auth is actually feasible. Even when true, re-auth only runs when the system has what it needs to perform it (for example, saved credentials for the required login fields), and only after a scheduled health check detects an expired session — so this flag has no effect when health_checks is false. When false, expired sessions detected by a health check are marked as NEEDS_AUTH instead of attempting re-auth.

ID of the underlying browser session driving the current flow (present when flow in progress). Use this to inspect or terminate the browser session via the /browsers API.

Whether this connection's stored requirements are eligible for unattended re-authentication. A true value can represent either fully satisfiable requirements or a best-effort attempt. It does not account for whether automatic re-authentication is enabled or parent workflow state such as an active flow or circuit-breaker cooldown, so it does not guarantee an attempt on the next health check. See can_reauth_reason for the specific outcome.

Machine-readable reason for the current value of can_reauth. Affirmative values (requirements are eligible for unattended re-authentication):

• external_credential — an external credential provider is attached
• cua_has_credential — CUA flow with a stored credential
• has_credential — Kernel credential is attached (optimistic; plan viability not checked)
• viable_plans_found — at least one stored login plan can be replayed
• no_requirements_recorded — no recorded credential requirements to fail against
• totp_reauth_allowed — TOTP is the only recorded requirement and a stored secret can generate the code
• optimistic_totp_attempt — TOTP was previously required but no reusable secret is stored; the connection remains eligible for a circuit-breaker-bounded attempt because the site may not challenge returning sessions
• requirements_satisfiable — recorded requirements contain no recognized blocker

Negative values (a human must complete the login flow):

• no_prior_successful_login — connection has never completed a successful login
• no_credential — no Kernel or external credential attached
• no_viable_plans — credential attached but no replayable login plan exists yet
• viable_plans_require_external_action — stored plans need an external step (email link, push, etc.)
• requires_external_action — recorded requirements include an external step
• requires_totp_without_secret — flow needs a TOTP code but no TOTP secret is stored
• requires_sms_code — flow needs an SMS code that cannot be received automatically
• requires_email_code — flow needs an email code that cannot be received automatically
• requires_customer_input — flow needs another field or choice that is unavailable during unattended re-authentication

Target domain for authentication

Machine-readable error code (present when flow_status=failed)

Error message (present when flow_status=failed)

Instructions for external action (present when flow_step=awaiting_external_action)

When the current flow expires (null when no flow in progress). A flow past this timestamp is no longer valid and its flow_status will be EXPIRED. Clients may start a new login to supersede a stale IN_PROGRESS flow past this timestamp.

Current flow status (null when no flow in progress)

Current step in the flow (null when no flow in progress)

Type of the current flow (null when no flow in progress)

Interval in seconds between automatic health checks. When set, the system periodically verifies the authentication status and triggers re-authentication if needed. Maximum is 86400 (24 hours). Default is 3600 (1 hour) or your plan minimum, whichever is larger. The minimum depends on your plan: Enterprise: 300 (5 minutes), Startup: 1200 (20 minutes), Hobbyist: 3600 (1 hour), Free: 21600 (6 hours).

Why health checks cannot verify this connection. Present when health checks are enabled but no auth check URL is available; a recent last_auth_check_at is not evidence of a valid session.

Whether periodic health checks are enabled for this connection. When false, the system will not automatically verify authentication status, and auto_reauth has no effect on the automatic flow (since re-auth is only triggered by a failed scheduled health check). Manually triggering a health check via the API still works regardless of this setting.

Whether a login blocked by a CAPTCHA the browser cannot solve pauses at AWAITING_HUMAN_INTERVENTION so a person can complete it in the live view.

URL to redirect user to for hosted login (present when flow in progress)

Unique identifier for the auth connection

Opaque identifier for the current canonical interaction. Required when submitting fields or choices and changes for each new actionable pause.

Deprecated alias for last_auth_check_at. Despite the name, this is the last health-check timestamp, not the last successful authentication. Use last_auth_check_at instead.

When the most recent auth health check ran for this connection, regardless of outcome. Updated on every health check and does not by itself indicate that the profile is currently authenticated - use status for that. May be newer than flow_expires_at when a flow is still in progress because health checks continue to run in parallel.

Browser live view URL for debugging (present when flow in progress)

Optional login page URL to skip discovery

URL where the browser landed after successful login

Name of the profile associated with this auth connection

Deprecated. Read browser.proxy instead. Retained during migration for existing clients.

Whether to record browser session replays for this connection by default. Useful for debugging login flows. Can be overridden per-login.

Whether credentials are saved after every successful login. One-time codes (TOTP, SMS, etc.) are not saved.

SSO provider being used (e.g., google, github, microsoft)

Last known authentication status of the managed profile. An inconclusive health check preserves this status and does not verify the current session.

Visible error message from the website (e.g., 'Incorrect password'). Present when the website displays an error during login.