Skip to main content
Authentication is how the agent gets past the login wall. Without it, the agent can only test whatever’s exposed to unauthenticated users, which on most modern apps is a pretty thin sliver of the real attack surface. Setting up auth properly is what unlocks the coverage that actually matters.

​
Supported authentication methods

1

Username / Password

Standard login credentials for the application. The agent signs in with a test account you provide. When you enable this method, you’ll enter the username and password directly in the card that appears.
2

TOTP

Time-based one-time passwords. If your app uses two-factor authentication with an authenticator app, provide the TOTP secret key (the base32 string you’d normally scan as a QR code). The agent uses it to generate valid one-time codes during testing, so it can get past 2FA without manual intervention.
3

API token

Token-based authentication for API endpoints. The agent attaches the bearer token you provide to every request it sends. Use this when your app authenticates via Authorization headers rather than a login form.
4

Custom header

If your app uses a non-standard header for auth (for example X-App-Key or a signed JWT passed in a custom field), you can tell the agent exactly what header value to use. The agent will include it on every request.
Each method is a toggle card. Enable the ones your app uses and fill in the credentials inline. You can enable multiple methods at once if your app requires them in combination (for example, username/password plus TOTP). If none are enabled, the agent runs an unauthenticated scan.

​
Email verification (delivered 2FA)

Some applications send a verification code or magic link to an email address as part of login. If your app does this, enable the Email verification (2FA) / Magic links toggle. The platform provisions a dedicated inbox address that the agent monitors during testing, so it can receive those codes and complete login without manual intervention.

​
How it works

1

Enable the toggle

Switch on “Email verification (2FA) / Magic links” in the authentication step. This tells the platform to set up an inbox for this application.
2

Generate or receive the email address

During the setup wizard, click “Generate email” to provision the address immediately. If you skip this step, the address is created automatically once the application is saved. Either way, you’ll see the provisioned address displayed with a copy button.
3

Set the address on your test account

Copy the provisioned address and update your test account’s email in the target application to use it. This is the critical step. The target app needs to send its verification emails to this address so the agent can read them.
4

The agent handles the rest

During a scan, when the app sends a verification code or magic link to the provisioned address, the agent picks it up from the inbox and uses it to complete authentication automatically.
This is especially useful for apps that enforce email-based 2FA on every login or use magic-link authentication as the primary sign-in method. Combined with username/password credentials, it lets the agent get past multi-step login flows that would otherwise block automated testing entirely.

​
Authentication instructions

Below the method cards there’s a free-text field for additional authentication details. Use it to describe anything the agent needs to know that doesn’t fit neatly into the fields above: custom login flows, session handling quirks, specific URLs the agent should hit to authenticate, or special access requirements. The agent reads this before every scan.

​
Captchas

Captchas on login pages generally aren’t a problem. The agent handles most common captcha providers out of the box, so you don’t need to do anything extra on your side. If your login uses something unusual and the agent gets stuck on it, reach out and we’ll work around it with you.

​
What’s coming soon

  • SSO via SAML and OIDC
  • OAuth 2.0 flows
  • Certificate-based authentication
These are on the roadmap. If any of them are the main thing blocking your setup, let us know and we’ll prioritize.