Skip to main content
Connect is the owner-authorized path. You already have an account at a third-party app — a vendor portal, a dashboard, an internal tool — and you want an agent to operate it. You hand Sente that account’s credentials once. Sente logs in with a real browser, vaults the credentials write-only, and keeps the login re-establishable so your agent can ask for a signed-in browser whenever it needs one. Same posture as giving Plaid your bank login or putting a shared credential in 1Password: you own the account, you authorize the access, you revoke it in one call. Nothing about the target site is circumvented — where the site insists on a human, a human is paged. Prefer this over Register whenever the account can exist already. It is the lower-risk path: no terms question about automated signup, no fraud wall, no CAPTCHA at the door.
Connect only accounts you own or are authorized to operate. Where the app supports it, connect a scoped member or service account rather than an admin login.

Before you start

Three limits decide whether an account can be connected at all:
  • SSO-only accounts cannot be connected. If the account signs in through Google/Microsoft/Okta or a passkey, there is no username and password to vault, and nothing for Sente to re-login with.
  • SMS 2FA works, but never autonomously. The code goes to a phone Sente does not have. Every login that triggers one blocks and pages a human.
  • Email 2FA needs a human too, unless the account uses an authenticator app (pass the TOTP seed, below) or its notification email is repointed to the Sente address (see the accordion at the end of Two-factor authentication).

Connect an account

POST /v1/connections with the app’s login URL and the credentials. identityId is optional — omit it and the backing email identity is provisioned from the app’s hostname. The call returns the connection and the run that logs in.
On success the run ends completed and the connection’s status is active. From then on it behaves like any other account: getSession, login, exportSession all take the connection id.

Lifecycle

1

Connect

You supply username, password, and optionally totpSeed. All three are encrypted with AES-256-GCM before they reach the database. A malformed seed is rejected here, at enrollment (400 BAD_TOTP_SEED) — not silently three re-logins later.
2

Sente logs in

A browser agent opens the login URL and signs in with your credentials in an isolated remote browser on a per-identity profile. The password is registered in a redaction vault first, so it is scrubbed from logs, step streams, and the activity feed.
3

Second factor, if any

An authenticator prompt is answered server-side from the vaulted seed. An email or SMS code blocks the run with MFA_REQUIRED and pages a human — see below.
4

Active

The run completes, the connection goes active, and the logged-in cookies persist on the identity’s browser profile.
5

Stay logged in

Ask for a session later and Sente checks how recently the login was confirmed. Stale, and it re-logs in first — from the vault, plus a server-computed TOTP code if there’s a seed — before handing back a browser. See Sessions.
6

Revoke or delete

Revoke stops all use and keeps the vault; delete additionally purges the stored password and seed.

Two-factor authentication

What happens at the 2FA prompt depends entirely on where the second factor lands: The TOTP seed is the base32 string behind a QR code’s “can’t scan it?” link, or the whole otpauth:// URI. Either form is accepted, normalised, and vaulted. The seed never reaches any model — the driving agent stops and reports, the server computes the six digits, and only those digits are sent onward.
A blocked run holds for about 10 minutes, then fails with BLOCKED_TIMEOUT and releases the browser. An emailed code has its own, often shorter, expiry. Have the account owner ready before you start the connect, and wire the run.blocked webhook or sente watch so the page reaches them immediately.
If you repoint the account’s notification email at the app to the Sente identity’s address, the login code lands in Sente’s own inbox and the run controller fetches and applies it without a human — the same mechanism that completes verification for registered accounts.Two things to know before relying on it:
  • You must assert it: pass verifyToIdentity: true in the POST /v1/connections body. It is raw-API only today — not exposed by the SDKs or the CLI.
  • It is an owner-authorized settings change you make at the app first. If nothing routes to the Sente address, the controller waits briefly, then falls back to blocking for a human. SMS codes never route here.

Credentials are write-only

Once vaulted, a connected account’s credentials cannot be read back through the API — not by you, not by your agent, not by anything holding your API key:
Only the run controller decrypts them, at the moment a login run needs them. You can overwrite them; you can purge them; you can never fetch them. (Accounts Sente created are the opposite — that generated password is yours to read, and every read is audited. See Register.)

Rotating credentials

After changing the password at the app, get the vault back in sync — otherwise the next re-login fails. Two ways:
Re-connecting without identityId does not rotate anything: it provisions a fresh identity and creates a second connection to the same app. Pass the identity, or use setCredentials on the connection id.

Revoke vs. delete

Delete purges what Sente stores; it does not touch the account at the app. If you need certainty that the credential is dead, rotate the password there too.

Failure paths

Call-time errors: Run outcomes — a blocked run is paused, not failed; clear it in the live view and resume:
  • Connect a scoped account, not your admin login. If the app has member roles, service accounts, or restricted API users, create one with the least privilege the agent needs and connect that.
  • Turn on TOTP where the app offers it. It is the one second factor that keeps re-login fully autonomous.
  • Prune what you don’t use. sente connections / connections.list(), then revoke.
  • Wire run.blocked before you need it. Re-logins happen on Sente’s schedule, not yours; a connected account with email 2FA will eventually block at an inconvenient moment.

Next steps

Sessions

Turn the connection into a logged-in browser — CDP or Playwright storageState.

Human takeover

The live view, the ~10-minute hold, and how a person clears a blocked login.

Security model

Where the vault key lives, what the browser agent sees, and what we don’t have yet.

API reference: connections

Request and response shapes for connect, list, revoke, delete.