BROWSER USE

- Browser Use Agents: give Browser Use a task and receive completed work. API V4 is current for new integrations.
- Browser Infrastructure: connect your agent or automation to managed browsers through SDK, REST, or CDP. Starts at $0.02/browser-hour.
- Developer tools: Open Source, Browser Harness, SDK, and MCP support the two products above.

[Developer Index](https://browser-use.com/index.md)
[Product Map](https://browser-use.com/llms.txt)
[Full Product Context](https://browser-use.com/llms-full.txt)
[Pricing](https://browser-use.com/pricing.md)
[Cloud Docs](https://docs.browser-use.com/cloud/quickstart)
[Open Source Docs](https://docs.browser-use.com/open-source/introduction)

---

# 2FA automation: logins the agent handles on its own

> Automate logins and two-factor codes without a person in the loop. Four ways the agent gets a code: TOTP generated from the secret, emailed codes read from an inbox the run owns, SMS forwarded to that inbox, and 1Password typing username, password and TOTP. Then a saved profile so the site stops asking.

[HTML page](https://browser-use.com/login-automation) · [2FA docs](https://docs.browser-use.com/cloud/guides/2fa) · [1Password and 2FA](https://docs.browser-use.com/cloud/guides/1password) · [Profiles](https://docs.browser-use.com/cloud/guides/authentication) · [Profile sync](https://docs.browser-use.com/cloud/guides/profile-sync)

## Four roads to the code

1. **Authenticator app (TOTP).** Give the agent the TOTP secret (shown as "can't scan the QR code" during 2FA setup) as a `sensitive_data` value whose name ends in `bu_2fa_code`. When the agent types the placeholder, a fresh six-digit code is generated. The model never sees the secret. In Cloud, the TOTP field of a 1Password item does the same.
2. **Emailed code.** Set `agentmail: true` on a V4 run (`POST /api/v4/runs`). The run gets a persistent inbox via AgentMail; the agent knows the address, signs up with it, waits for the verification email, and reads the code. The open-source library does the same with AgentMail tools or the built-in Gmail integration (`browser_use.integrations.gmail`).
3. **SMS code.** Forward the number's texts to an inbox the agent can read (carrier forwarding, Google Voice, or a Twilio number that emails you). From there it is an emailed code.
4. **Password manager.** Pass `opVaultId` and `opVaultAllowedDomains` on a V4 run, or per-field `secretBindings` (alias, source, allowedDomains). The server types username, password or TOTP on the allowed hosts; the model sees only aliases. Browser Use does not store browser passwords.

## Then stop being asked

Save a profile after the first login and pass `profileId` on later runs (`browser_settings={"profileId": ...}`) or standalone browsers (`{"profileId": ...}` on `POST /api/v4/browsers`). Cookies, localStorage and login state persist, so the site does not challenge again while they are valid. Already logged in on your laptop? `curl -fsSL https://browser-use.com/profile.sh | sh` syncs selected cookies from your Chrome into a cloud profile.

## Keep it contained

`allowed_domains` and `prohibited_domains` limit where a logged-in agent can navigate. `use_vision=False` keeps screenshots of sensitive pages away from the model. Works for Playwright sessions at $0.02 per browser-hour as well as for agent runs.

## When a person is still needed

Push-approval 2FA on a phone you do not control, or a bank that insists on a human. Enterprise runs can pause at that step and hand the live view to someone; the session continues after.