Scan a page behind a login

What to know

Project scans can use a configured email/password form or a pasted session. Credentials are supplied for each scan and held in worker memory; project settings store non-secret login configuration.

What to do

1. Open Project settings and choose the login method. Use No login only for pages the scanner can reach without a session.
2. For Email and password, enter the login URL and selectors required by your application.
3. For SSO, a one-time code, or a magic link, choose the pasted-session method instead.
4. Open New scan, enter the target page, and supply fresh credentials or session JSON.

What happens next

LatchKey attempts form login once. A failed authentication produces a named reason rather than repeated attempts that could lock the account.

If you need more help

Prefer an authorized test account with access only to the pages you want to inspect. Never put a password in the URL, project settings, or a support message.

• Paste a session
• Login form troubleshooting