Before you start
Three limits decide whether an account can be connected at all:- SSO-only accounts cannot be connected. If the account signs in through Google/Microsoft/Okta or a passkey, there is no username and password to vault, and nothing for Sente to re-login with.
- SMS 2FA works, but never autonomously. The code goes to a phone Sente does not have. Every login that triggers one blocks and pages a human.
- Email 2FA needs a human too, unless the account uses an authenticator app (pass the TOTP seed, below) or its notification email is repointed to the Sente address (see the accordion at the end of Two-factor authentication).
Connect an account
POST /v1/connections with the app’s login URL and the credentials. identityId is optional —
omit it and the backing email identity is provisioned from the app’s hostname. The call returns the
connection and the run that logs in.
completed and the connection’s status is active. From then on it
behaves like any other account: getSession, login, exportSession all take the connection id.
Lifecycle
1
Connect
You supply
username, password, and optionally totpSeed. All three are encrypted with
AES-256-GCM before they reach the database. A malformed seed is rejected here, at enrollment
(400 BAD_TOTP_SEED) — not silently three re-logins later.2
Sente logs in
A browser agent opens the login URL and signs in with your credentials in an isolated remote
browser on a per-identity profile. The password is registered in a redaction vault first, so it
is scrubbed from logs, step streams, and the activity feed.
3
Second factor, if any
An authenticator prompt is answered server-side from the vaulted seed. An email or SMS code
blocks the run with
MFA_REQUIRED and pages a human — see below.4
Active
The run completes, the connection goes
active, and the logged-in cookies persist on the
identity’s browser profile.5
Stay logged in
Ask for a session later and Sente checks how recently the login was confirmed. Stale, and it
re-logs in first — from the vault, plus a server-computed TOTP code if there’s a seed — before
handing back a browser. See Sessions.
6
Revoke or delete
Revoke stops all use and keeps the vault; delete additionally purges the stored password and
seed.
Two-factor authentication
What happens at the 2FA prompt depends entirely on where the second factor lands:
The TOTP seed is the base32 string behind a QR code’s “can’t scan it?” link, or the whole
otpauth:// URI. Either form is accepted, normalised, and vaulted. The seed never reaches any
model — the driving agent stops and reports, the server computes the six digits, and only those
digits are sent onward.
Making email 2FA autonomous by repointing the notification address
Making email 2FA autonomous by repointing the notification address
If you repoint the account’s notification email at the app to the Sente identity’s address, the
login code lands in Sente’s own inbox and the run controller fetches and applies it without a human
— the same mechanism that completes verification for registered accounts.Two things to know before relying on it:
- You must assert it: pass
verifyToIdentity: truein thePOST /v1/connectionsbody. It is raw-API only today — not exposed by the SDKs or the CLI. - It is an owner-authorized settings change you make at the app first. If nothing routes to the Sente address, the controller waits briefly, then falls back to blocking for a human. SMS codes never route here.
Credentials are write-only
Once vaulted, a connected account’s credentials cannot be read back through the API — not by you, not by your agent, not by anything holding your API key:Rotating credentials
After changing the password at the app, get the vault back in sync — otherwise the next re-login fails. Two ways:Revoke vs. delete
Delete purges what Sente stores; it does not touch the account at the app. If you need certainty
that the credential is dead, rotate the password there too.
Failure paths
Call-time errors:
Run outcomes — a
blocked run is paused, not failed; clear it in the live view and resume:
Recommended practice
- Connect a scoped account, not your admin login. If the app has member roles, service accounts, or restricted API users, create one with the least privilege the agent needs and connect that.
- Turn on TOTP where the app offers it. It is the one second factor that keeps re-login fully autonomous.
- Prune what you don’t use.
sente connections/connections.list(), then revoke. - Wire
run.blockedbefore you need it. Re-logins happen on Sente’s schedule, not yours; a connected account with email 2FA will eventually block at an inconvenient moment.
Next steps
Sessions
Turn the connection into a logged-in browser — CDP or Playwright
storageState.Human takeover
The live view, the ~10-minute hold, and how a person clears a blocked login.
Security model
Where the vault key lives, what the browser agent sees, and what we don’t have yet.
API reference: connections
Request and response shapes for connect, list, revoke, delete.
