How AI agents can handle 2FA codes, with you in charge

After the password, the site sends a code to a phone, an inbox or an authenticator app that belongs to a person. The agent has none of them, so it stops at the code screen and waits, or fails.

Turning 2FA off is not the fix. It removes the protection for everyone who uses the account. Keep 2FA on and give the agent its own way to get the code, on its own seat where the site offers one.

• ›Authenticator codes: six digits that change every 30 seconds, made from a setup key you saved when you turned on 2FA.
• ›Emailed codes and sign-in links: the site mails a code or a link to the address on the account.
• ›Text message codes: the site texts a code to the phone number on the account.

save_authenticator stores the setup key on the identity, encrypted, and never returns it. fill_code types the current code into the page. A hosted agent whose browser runnerID can't reach calls get_authenticator_code, which returns only the six digits.

The full guide is at /guides/authenticator-codes-ai-agents.

Each identity has its own inbox address. Use it as the email on the agent's own seat, not on your personal account. wait_for_email_code and fill_email_code type the code into the page without returning it, and get_email_code returns it for hosted agents. open_magic_link opens a sign-in link only when its host is the site or a trusted subdomain.

The full guide is at /guides/ai-agent-inbox-verification-codes.

A phone number for SMS codes is coming to runnerID. Until then, where a site lets you choose, set the agent's seat to use an authenticator app or email for its codes.

Each identity has site rules: the sites it may use, and the actions that need your approval. A request for a site outside the list is refused, and a saved secret is typed only into the site it was saved for or a trusted subdomain.

Before a step you marked as risky, the agent calls request_approval. runnerID emails you a link to approve or deny, or you answer in the owner console. wait_for_approval holds the agent until you answer.

Every code fill and code release goes into an append-only log you read in the console. Tool results never include a password or seed. Only get_email_code and get_authenticator_code return a code, and each release is logged. Revoke shuts it all off at once. The agent can no longer use its logins, codes, inbox or saved sessions.

Some steps are meant for a person, and that is fine. OpenAI's help page for ChatGPT's cloud browser says: "If ChatGPT gets stuck on a task, it will ask you to take over the cloud browser on your phone or computer." [4] Browserbase suggests logging in by hand once with Session Live View and reusing the saved context after that [3].

When your agent reaches a step it can't finish, it will hand that step to runnerID, which does it as the identity and hands back the result. Every handoff will be logged. This is coming; it is not part of runnerID today.

You pass the setup key in sensitive_data under a name that ends in bu_2fa_code, and the agent makes a fresh six-digit code when it types that name. For emailed or texted codes, its docs show follow-up tasks, with AgentMail inboxes for email [1].

Its Credentials API, in beta, takes a totpSecret with the username and password and fills the code in Steel sessions [2].

You sign in through a secure form and complete any two-factor steps yourself; OpenAI says the username and password entered there are not visible to the model [4].

• ›If runnerID can reach the browser (a hosted browser or one on your own server): Agents that drive a browser runnerID can reach, such as a hosted browser (Browserbase, Steel) or one on your own server, get the strongest mode: runnerID types the password itself.
• ›If the browser is on your own laptop: When the browser runs on your own laptop, the helper uses its local route: the password passes through your own code once to be typed, and still never reaches the model.
• ›If a hosted agent's browser is out of runnerID's reach: Hosted agents that connect over MCP get authenticator and emailed codes returned to them, and approvals and the log work the same. Typing a password into the page needs the runnerID helper next to the browser (Stagehand, Playwright or Browser Use), on a laptop or in a cloud container.

To connect Claude, sign in: open Settings, then Connectors, choose Add custom connector, paste https://api.runnerid.torchrunner.ai/mcp and approve on runnerID's own page. Cursor and Claude Code use your API key as a Bearer token. Helpers for your own code take the browser's address as http, https, ws or wss.

Setup steps for each helper are in /guides/playwright-stagehand-browser-use-login.

npm install @runnerid/stagehand
npm install @runnerid/playwright
pip install runnerid
npx -y @runnerid/mcp-local

Keep the setup key out of your code.

Emailed codes without your personal inbox.

Site rules, approval by email link, the log and revoke.

Connect in a few steps.

Four checks before you say yes.

• ›1. Browser Use, Authentication: https://docs.browser-use.com/open-source/customize/browser/authentication
• ›2. Steel, Credentials API: https://docs.steel.dev/overview/credentials-api/overview
• ›3. Browserbase, Website authentication: https://docs.browserbase.com/platform/identity/authentication
• ›4. OpenAI Help Center, Using cloud browser in ChatGPT: https://help.openai.com/en/articles/20001280-using-cloud-browser-in-chatgpt
• ›5. runnerID API docs: https://api.runnerid.torchrunner.ai/llms.txt

Browser Use, Steel, Browserbase, Stagehand, Playwright and AgentMail belong to their owners. ChatGPT is a trademark of OpenAI. Claude is a trademark of Anthropic. Cursor is a trademark of Anysphere. runnerID and Torchrunner are independent of, and not affiliated with, endorsed by or sponsored by any of them.