How to log a cloud browser agent into sites without prompts

A password in the prompt goes to the model, and may land in tool output and logs. Steel's own page puts it this way: sending credentials "to a browser-agent, powered by an opaque LLM API that may or may not be training on your data, represents a non-trivial security risk" [1]. The safe pattern: the model names the site, and a service outside the model types the login into the page.

Some sites tell owners never to share their login. Shopify [9], Amazon [10] and the IRS [11] are examples. Use the staff seat, user permissions or authorization they offer instead. runnerID is not for bank accounts.

Steel's Credentials API is in beta, and Steel says it is free to store and use credentials during the beta [1]. A credential is stored with an origin and a namespace, and can include a totpSecret for one-time codes [1]. You ask for injection when the session starts; the options autoSubmit, blurFields and exactOrigin all default to true [1]. Steel says fields are typically filled within 2 seconds of the login page loading [1]. It works in Steel sessions.

Kernel offers two approaches [2]. With Fill from Vault, your app or agent owns navigation and calls fill. With Managed Auth, Kernel runs the login flow, with health checks and automatic re-authentication attempts. Kernel says it "doesn't return stored sensitive fields in api responses or add them to model context" [2].

Its docs also note that "the fill operation writes real values into the browser. Page scripts, extensions, developer tools, and an agent with unrestricted browser access can read them after fill" [2]. That is true of any tool that types into a page, runnerID included, so give the agent the narrowest browser access your workflow allows.

The user connects a 1Password account and approves each login in the 1Password desktop app, and the 1Password extension fills it in a Browserbase session without returning the values to your application [3]. The approval prompt closes after two minutes [3]. Its docs say to deliver approval links through your own authenticated app, outside model context and logs [3].

Agents that drive a browser runnerID can reach, such as a hosted browser (Browserbase, Steel) or one on your own server, get the strongest mode: runnerID types the password itself.

• ›1. Save the login (and an authenticator key, if the site uses one) in the owner console at https://api.runnerid.torchrunner.ai/console. Neither is shown back.
• ›2. Start the cloud browser session and get its CDP address. On Browserbase, creating a session returns a connectUrl, the address Playwright and Puppeteer connect to [4]. On Steel, the documented address is wss://connect.steel.dev?apiKey=<key>&sessionId=<id> [6].
• ›3. The agent calls fill_login over MCP with the site and the browser's address. runnerID types the saved username and password into the matching page. The fill response names the fields. It does not include the password.
• ›4. If the site asks for a code next, fill_code types the authenticator code and fill_email_code types an emailed code. Neither code is returned. See the authenticator guide at /guides/authenticator-codes-ai-agents and the inbox guide at /guides/ai-agent-inbox-verification-codes.
• ›5. save_session and restore_session keep the agent signed in between runs. They take the same CDP address as fill_login, including the Browserbase and Steel connect URLs from step 2. See /guides/keep-ai-agent-signed-in.

Browserbase says to treat the connection URL as a credential: anyone with it can connect while the session is active [5]. Some Browserbase examples build the address with your Browserbase API key in the query string instead [7]. Steel's documented address carries your Steel API key in the query string [6]. So the address you pass to fill_login can contain the vendor's API key.

runnerID uses the address only to connect. It does not log or store it. Your own agent code and its logs still see the address, so keep them as private as the API key.

CDP URLs must be http, https, ws or wss, and loopback, private, link-local and metadata addresses are rejected. A secret is typed only into the host it was saved for (a leading www. is ignored) or a trusted subdomain. The page URL is read again just before typing, and if the page moved, the call returns 409 page_navigated and types nothing [8].

Tool results never include a password or seed. Only get_email_code and get_authenticator_code return a code, and each release is logged.

If every agent runs in one vendor's browser, that vendor's own feature keeps logins next to the sessions. If you use more than one tool or browser, runnerID by Torchrunner is "cross-platform agent identity: one identity that follows the operator across tools", with logins, codes, an inbox, saved sessions, approvals and the log on that identity, and revoke shuts it all off. runnerID has a Free plan with no card, and paid plans start at $12 a month.

Every entry for Steel, Kernel and Browserbase comes from that vendor's own page. Not stated means the page did not say, as of October 24, 2026.

• ›Where the secret is stored: Steel's credential service, encrypted [1]
• ›Who types it: Steel injects it into the Steel session [1]
• ›Codes: TOTP with a totpSecret [1]
• ›Inbox: Not stated
• ›Approvals: Not stated
• ›Log: Not stated
• ›Price: Free to store and use during the beta [1]

• ›Where the secret is stored: A Kernel vault [2]
• ›Who types it: Kernel's fill writes it into the browser [2]
• ›Codes: Not stated
• ›Inbox: Not stated
• ›Approvals: Not stated
• ›Log: Not stated
• ›Price: Not stated

• ›Where the secret is stored: The user's 1Password vault [3]
• ›Who types it: The 1Password extension, in the Browserbase session [3]
• ›Codes: Not stated
• ›Inbox: Not stated
• ›Approvals: The user approves each login in the 1Password desktop app [3]
• ›Log: Not stated
• ›Price: Not stated

• ›Where the secret is stored: runnerID's vault, encrypted per identity
• ›Who types it: runnerID, into a browser it can reach
• ›Codes: Authenticator codes generated and typed; emailed codes caught and typed
• ›Inbox: One per identity
• ›Approvals: Site rules and approval by email link
• ›Log: Append-only log, and revoke
• ›Price: From $12 a month

A laptop browser usually sits at a private or loopback address, and server fill rejects those addresses [8]. From "Does my agent see my passwords?":

When runnerID can reach the browser, it types the password straight into the page, so it never enters the model, its tool output or its logs. When the browser runs on your own laptop, the helper uses its local route: the password passes through your own code once to be typed, and still never reaches the model.

From "Does it work with hosted agents?":

Hosted agents that connect over MCP get authenticator and emailed codes returned to them, and approvals and the log work the same. Typing a password into the page needs the runnerID helper next to the browser (Stagehand, Playwright or Browser Use), on a laptop or in a cloud container.

This guide covers the first case only: a cloud browser runnerID can reach.

• ›1. Steel, Credentials API: https://docs.steel.dev/overview/credentials-api/overview
• ›2. Kernel, Authentication overview: https://www.kernel.sh/docs/auth/overview
• ›3. Browserbase, 1Password Agentic Autofill: https://docs.browserbase.com/integrations/1password/agentic-autofill
• ›4. Browserbase, Using a browser session: https://docs.browserbase.com/platform/browser/getting-started/using-browser-session
• ›5. Browserbase, MPP quickstart (connection URL as a credential): https://docs.browserbase.com/integrations/mpp/quickstart
• ›6. Steel docs for agents (connect URL): https://docs.steel.dev/llms.txt
• ›7. Browserbase, Braintrust TypeScript example (API key in the connect URL): https://docs.browserbase.com/integrations/braintrust/typescript
• ›8. runnerID API docs: https://api.runnerid.torchrunner.ai/llms.txt
• ›9. Shopify Help Center, Account security: https://help.shopify.com/en/manual/privacy-and-security/account-security
• ›10. Amazon Seller Forums, staff post "User Permissions Guide for Amazon Sellers": https://sellercentral.amazon.com/seller-forums/discussions/t/c63f8fc4-c813-4ba2-a864-ff4eef117223
• ›11. IRS, Online account for individuals FAQ: https://www.irs.gov/payments/online-account-for-individuals-frequently-asked-questions

Keep the seed out of your code; fill_code and get_authenticator_code.

Saved sessions in Playwright, Browser Use, Browserbase, Kernel, Steel and runnerID.

Steel, Kernel, Browserbase, Playwright, Puppeteer, Stagehand and Browser Use belong to their owners. 1Password is a trademark of AgileBits. Claude is a trademark of Anthropic. Cursor is a trademark of Anysphere. runnerID and Torchrunner are independent and are not affiliated with, endorsed by or sponsored by any of them.