Use a session for SSO, MFA, or magic-link login

What to know

A browser session can contain cookies and local storage that grant access to your account. Treat the exported file like a password. Keep it out of source control, screenshots, and support messages.

What to do

1. Use Playwright locally to open your login page and save storage state with the command below. Replace the example URL with your login page.
2. Complete sign-in yourself, including any MFA step, and reach the protected page. Close the browser window to finish saving.
3. In Project settings, choose the pasted-session login method. Open New scan and paste the JSON file contents into Session state JSON.
4. Start the scan while the session is fresh. Remove the local file when no longer needed and revoke the test session if appropriate.

npx playwright open --save-storage=session.json https://app.example.com/login

What happens next

LatchKey reuses the supplied state for the scan; it does not handle your one-time codes. An expired state needs a fresh export, not repeated retries of the same file.

If you need more help

Some applications keep login state in mechanisms that are not captured by this flow, such as session storage. If a fresh export still opens the login page, ask your developer or support to review the authentication setup.

• Playwright authentication guide
• Session expired