- Ensures access to restricted content without manual intervention.
- Reduces session expiration issues by persisting login states.
- Maintains consistent browser identity across sessions.
Strategies for handling authentication
Handling authentication in automation requires maintaining session state and resolving challenges like CAPTCHAs or multi-factor authentication (MFA). Browserbase provides several strategies to help you authenticate reliably while ensuring security and efficiency.- Create a session with context, proxies, and fingerprinting.
- Use the Session Live View to log into the website.
- Use the context ID to persist the authentication state across future sessions.
Create a session with contexts, proxies, and fingerprinting
Ensure seamless authentication by persisting login sessions and preventing IP-based blocking.- Apply Contexts → Store cookies, session tokens, and local storage to prevent repeated logins. Log in once, then reuse the saved authentication state.
- Enable Verified → Use consistent browser fingerprints recognized by bot protection partners.
- Use Proxies → Rotate residential proxies and match IP locations to prevent tracking and login restrictions.
- Node.js
- Python
Use the session live view to log in
For authentication workflows, the best practice is to log in manually once using Session Live View, then persist the authentication state across future sessions using contexts. This approach ensures secure, repeatable logins without needing manual input every time.- Start a new session and retrieve the Session Live View URL.
- Open the Live View in your browser to interact with the session in real time.
- Once logged in, the session’s authentication data (cookies, session tokens) is stored.
- Save the session context id so future sessions can reuse the authentication state without logging in again.
Taking a session's remote control with Session Live View
Incorporate a human in the loop to complete the authentication process.
Use the context ID to persist the authentication state across future sessions
After logging in once, you can reuse the authentication state by storing it in a context. This allows future sessions to bypass the login process, maintaining access to authenticated pages without needing manual input. Now, any session using this context.id will start already logged in, eliminating the need to authenticate again. By persisting authentication with contexts, you can ensure seamless automation, reduce login failures, and improve session continuity.2FA challenges
Two-step verification (via authenticator apps or SMS) or magic links usually require human intervention in the loop. There are 2 main strategies to manage 2FA:- Disable 2FA or create an app password
- Enable Remote Control of your Session
Disable 2FA or create an app password
For an internal tool, try to turn off the two-step verification. For an authentication flow requiring some level of security, try to create an app password.Enable remote control of your session
If a two-step verification mechanism can’t be bypassed or disabled, consider handing back control to the end user with Session Live URLs.Taking a session's remote control with Session Live View
Let your end users complete the two-step verification process as part of your
automation.
Accessing an authentication flow with Verified
Many auth flows try to block automation:- IP address restrictions
- User agent filtering
- CAPTCHAs
- Rate limiting
- Proxies for consistent geolocation and network identity
- Verified sessions recognized by bot protection partners
Speed up your automation by reusing cookies
Some websites or web apps rely on cookie-based sessions, which can be easily retrieved and reused to speed up your automation. The code examples below showcase how to retrieve and set cookies to avoid having your automation go through the authentication flow at each run:- Node.js
- Python
Playwright
Using Functions? When deploying authentication flows with Functions, you can combine context persistence with serverless execution. Define your function with a
contextId in the session configuration to maintain authenticated state across function invocations.Handling passkeys
Passkeys are a modern authentication method that can present challenges for automation since they typically require user interaction. When automating sites that use passkeys, you’ll often want to disable or bypass them since the required user interactions aren’t supported in automated sessions.Disable passkeys in your session
To prevent passkey prompts from appearing and potentially blocking your automation, you can disable them using the Chrome DevTools Protocol (CDP). Here’s how:- Node.js
- Python
- Creates a new Browserbase session
- Connects to the browser using CDP
- Enables the WebAuthn API
- Adds a virtual authenticator that prevents real passkey prompts
Alternative authentication methods
When passkeys are enabled on a site, there’s usually an alternative authentication method available (like username/password). After disabling passkeys, look for these alternative methods:- “Sign in with password” links
- “Other sign-in options” buttons
- Username/password form toggles