Auth flows
For public pages, put the URL in input / url on POST /api/v1/responses — no credential required. For sites that need login, store secrets in your Banana Peel vault — in Console → Vault or via POST /api/v1/credentials — and pass credential_id on the run, or include login steps in the task text. Vault credentials are owned by your signed-in account — they are never pulled from a shared runners catalog.
Login
- Browser-backed runners follow instructions like "log in and…" with an act-observe loop when the runner supports it.
- Password-type fields are masked in step traces where the runner emits steps (
••••••). - Pass
credential_idfrom your account vault to inject username / password (and optional TOTP) at run time onto whichever runner routing selects — vault usage does not pin any runner. Pinroutingwhen runner choice matters; the credential's custody policy (defaulttrusted_runners) is a hard filter. See Custody.
MFA & 2FA
Full contract: MFA / OTP. When a target site asks for MFA, 2FA, or an OTP, the run pauses immediately and asks the user for the code. It does not keep trying other runners.
On the Browser Agent API, prefer background: true so the run can pause for a human code without holding your create socket open. Poll GET /api/v1/responses/:id until status is requires_action (or handle the response.requires_action webhook). MCP create_response waits until that pause and returns human_action_required plus required_action.
- Poll
GET /api/v1/responses/{id}untilstatus: "requires_action". - Read
required_action.submit_input(kind: otp / text / confirm,channel,submit.path). - Submit the code with POST /api/v1/responses/{id}/input { "code": "123456" } (or { "answer": "…" } for text/confirm). MCP: submit_input({ id, code }). Then keep polling until completed or failed.
- If the vault credential (or request totp_secret) includes a base32 TOTP seed, OTP asks are answered in-process and the run does not pause. Username/password alone is not enough — the run still pauses for the code.
CAPTCHA and other bot-detection gates (reCAPTCHA, hCaptcha, Turnstile, DataDome, Cloudflare challenge, “prove you are human”) are solved, re-routed, or end blocked with reason bot_challenge. They never become a human text prompt.
While paused, banana_peel.status may show needs_human. That pause does not automatically fall through your routing chain — see Fallback semantics. Full examples: MFA / OTP and Create a response → MFA.