SI FabrikDocs
/
sifabrik.com ↗
Projects

Test logins

Save test accounts the agent can sign in with by name, without the password passing through its prompt, transcript or tool results.

A test login is a saved account (username, password and optionally a TOTP secret) that agents use through the browser_sign_in tool. SI Fabrik fills the sign-in form in the agent's browser over DevTools, only on the origins you allow. The password never appears in the agent's prompt, tool results or stream.

Before you begin#

The project needs the browser on (browser.enabled: true) and a sandbox.

Add a test login#

  1. Open Edit Project

    Click … in the project header and choose Edit Project….

  2. Add Test Login

    In Test logins, press Add Test Login and fill in:

    • Name: what the agent asks for, for example admin or shopper (letters, digits, spaces, - and _).
    • Origins: where the form may be filled, such as http://localhost:3000 or https://*.staging.example.com.
    • Username and Password.
    • TOTP secret (optional): the base32 secret for an account with an authenticator-app second factor.
  3. Save

    Logins are stored in the Keychain, one item per project, never in WORKFLOW.md.

A login with problems (no origin, an invalid origin, a missing password, an invalid TOTP secret) is shown with the problem and isn't offered to agents.

How the agent uses it#

  1. The agent opens the sign-in page with the browser tools.
  2. It calls browser_sign_in with the login's name. The tool's description lists the saved logins by name, username and origins.
  3. SI Fabrik checks the page is on one of the login's origins, fills the username and password (and a fresh one-time code when the login has a TOTP secret), handles username-first forms, and submits.
  4. If the sign-in redirects to another origin, SI Fabrik stops and says so. Captchas, SSO on another origin and second factors without a TOTP secret are reported back, so the agent can mention them and you can take control.

Origins match exactly on scheme and port. *. matches subdomains only, so https://*.staging.example.com matches https://app.staging.example.com but not https://staging.example.com.

What it protects, and what it doesn't#

It keeps test credentials out of the repository, prompts, transcripts, logs and pull requests, and stops them being typed into a page on another origin, such as a lookalike page or a prompt-injected redirect. Run history and anything SI Fabrik posts (pull requests, comments, parked-task reasons) are redacted for the password when it's 8 characters or more.

Use test accounts only

The agent shares the sandbox with the browser, so an agent determined to do so could read a filled-in password back out of the page. Never save a real person's account. Passwords under 8 characters aren't redacted from run history.

See also#