---
title: "Start login flow"
method: POST
path: "/auth/connections/{id}/login"
tags: ["Managed Auth"]
---

# Start login flow

`POST /auth/connections/{id}/login`

Starts a login flow for the auth connection. Returns immediately with a hosted URL for the user to complete authentication, or triggers automatic re-auth if credentials are stored.

## Path parameters

- `id` string, required

## Request body

- LoginRequest — Request to start a login flow
  - `browser` ManagedAuthBrowserConfig — Browser configuration applied to browser sessions created for a managed auth connection. Managed auth controls the profile, headless mode, timeout, start URL, kiosk mode, and viewport.
    - `proxy` union — Browser proxy configuration. Provide exactly one of mode, id, or name; an empty object is invalid. Set mode to direct for no proxy regardless of stealth. Set mode to default to use the browser's stealth-derived default: Kernel's default stealth proxy when stealth=true, or direct egress when stealth=false. Select id or name to use that proxy regardless of stealth. The selected proxy must be in the same project as the browser. Names must match exactly one active proxy; use id for stable references. Proxy configuration changes only egress and does not change stealth or CAPTCHA solver behavior. A stealth browser using mode=direct still runs in stealth mode with the CAPTCHA solver enabled. When proxy is omitted on browser creation, stealth browsers use Kernel's default stealth proxy and non-stealth browsers use direct egress. When omitted on update, the current configuration is unchanged.
      - object
        - `id` string — Proxy ID.
        - `mode` 'direct' | 'default', required — Proxy egress mode. direct forces no proxy regardless of stealth. default uses the browser's stealth-derived default: Kernel's default stealth proxy when stealth=true, or direct egress when stealth=false. default is primarily useful on browser update to restore the browser default after selected-proxy egress.
        - `name` string — Proxy name. Must match exactly one active proxy in the project.
      - object
        - `id` string, required — Proxy ID.
        - `mode` 'direct' | 'default' — Proxy egress mode. direct forces no proxy regardless of stealth. default uses the browser's stealth-derived default: Kernel's default stealth proxy when stealth=true, or direct egress when stealth=false. default is primarily useful on browser update to restore the browser default after selected-proxy egress.
        - `name` string — Proxy name. Must match exactly one active proxy in the project.
      - object
        - `id` string — Proxy ID.
        - `mode` 'direct' | 'default' — Proxy egress mode. direct forces no proxy regardless of stealth. default uses the browser's stealth-derived default: Kernel's default stealth proxy when stealth=true, or direct egress when stealth=false. default is primarily useful on browser update to restore the browser default after selected-proxy egress.
        - `name` string, required — Proxy name. Must match exactly one active proxy in the project.
    - `stealth` boolean — Whether managed auth browser sessions use stealth mode. Defaults to true when omitted.
    - `telemetry` BrowserTelemetryRequestConfig — Telemetry request configuration for a browser session.
      - `browser` BrowserTelemetryCategoriesConfig — Per-category telemetry capture settings layered onto the default set. The operational signals (control, connection, system, captcha) are on by default and are opt-out: set one to enabled=false to stop capturing it. The CDP categories (console, network, page, interaction), screenshot and platform are off by default and are opt-in: set enabled=true to capture them.
        - `captcha` BrowserTelemetryCategoryConfig — Per-category telemetry configuration.
          - `enabled` boolean — Whether this category is captured. Operational categories (control, connection, system, captcha) default to true; set false to opt out. CDP categories (console, network, page, interaction), screenshot and platform default to false; set true to opt in.
        - `connection` BrowserTelemetryCategoryConfig — Per-category telemetry configuration.
          - `enabled` boolean — Whether this category is captured. Operational categories (control, connection, system, captcha) default to true; set false to opt out. CDP categories (console, network, page, interaction), screenshot and platform default to false; set true to opt in.
        - `console` BrowserTelemetryCategoryConfig — Per-category telemetry configuration.
          - `enabled` boolean — Whether this category is captured. Operational categories (control, connection, system, captcha) default to true; set false to opt out. CDP categories (console, network, page, interaction), screenshot and platform default to false; set true to opt in.
        - `control` BrowserTelemetryControlConfig — Configuration for the control category. Same enabled semantics as any other category, plus settings for the browser-control commands the CDP proxy reports.
          - `cdp` BrowserTelemetryCdpControlConfig — Settings for the cdp_command events the CDP proxy reports.
            - `excluded_methods` BrowserCdpCommandMethod[] — Methods to leave out of the cdp_command stream. Omit the list to keep the current one; send an empty list to report every supported method again. Exclusion is a telemetry setting only: an excluded command is still relayed to the browser unchanged, it simply produces no event. Use it to drop the highest-volume methods — Input.dispatchMouseEvent during a humanized cursor path, or Page.captureScreenshot under a screencast — without turning the whole category off. Excluded commands are counted in cdp_disconnect.telemetry_excluded.
          - `enabled` boolean — Whether this category is captured. Control is on by default; set false to opt out.
        - `interaction` BrowserTelemetryCategoryConfig — Per-category telemetry configuration.
          - `enabled` boolean — Whether this category is captured. Operational categories (control, connection, system, captcha) default to true; set false to opt out. CDP categories (console, network, page, interaction), screenshot and platform default to false; set true to opt in.
        - `network` BrowserTelemetryCategoryConfig — Per-category telemetry configuration.
          - `enabled` boolean — Whether this category is captured. Operational categories (control, connection, system, captcha) default to true; set false to opt out. CDP categories (console, network, page, interaction), screenshot and platform default to false; set true to opt in.
        - `page` BrowserTelemetryCategoryConfig — Per-category telemetry configuration.
          - `enabled` boolean — Whether this category is captured. Operational categories (control, connection, system, captcha) default to true; set false to opt out. CDP categories (console, network, page, interaction), screenshot and platform default to false; set true to opt in.
        - `platform` BrowserTelemetryCategoryConfig — Per-category telemetry configuration.
          - `enabled` boolean — Whether this category is captured. Operational categories (control, connection, system, captcha) default to true; set false to opt out. CDP categories (console, network, page, interaction), screenshot and platform default to false; set true to opt in.
        - `screenshot` BrowserTelemetryCategoryConfig — Per-category telemetry configuration.
          - `enabled` boolean — Whether this category is captured. Operational categories (control, connection, system, captcha) default to true; set false to opt out. CDP categories (console, network, page, interaction), screenshot and platform default to false; set true to opt in.
        - `system` BrowserTelemetryCategoryConfig — Per-category telemetry configuration.
          - `enabled` boolean — Whether this category is captured. Operational categories (control, connection, system, captcha) default to true; set false to opt out. CDP categories (console, network, page, interaction), screenshot and platform default to false; set true to opt in.
      - `enabled` boolean — Request shortcut for browser telemetry capture. True enables capture; with no browser category settings it captures the default set (control, connection, system, captcha), and any browser category settings are layered onto that default set. On update, enabled=true resolves the config fresh from the default set plus any provided categories, replacing the session's current selection rather than merging onto it; omit enabled to merge categories onto the current selection instead. False stops capture on update and starts no capture on create. enabled=false cannot be combined with browser category settings.
      - `export` BrowserTelemetryExportRequestConfig — Export destinations for a session's captured telemetry, by protocol. Honored when creating a browser, including the browser a managed auth connection creates for a login. Browser pools do not support export and reject it; on a browser update it is ignored, so the session keeps the destination it was created with.
        - `otlp` BrowserTelemetryOTLPExportRequestConfig — OTLP export settings for a browser session.
          - `destination` union — OTLP destination selection. Provide either id or name. The destination must exist in the project the request resolves to.
            - object
              - …
            - object
              - …
          - `enabled` boolean — Whether to export captured telemetry over OTLP. Setting destination implies enabled=true, so this only needs to be set explicitly to disable export (enabled=false with a destination is rejected).
  - `browser_telemetry` BrowserTelemetryRequestConfig — Telemetry request configuration for a browser session.
    - `browser` BrowserTelemetryCategoriesConfig — Per-category telemetry capture settings layered onto the default set. The operational signals (control, connection, system, captcha) are on by default and are opt-out: set one to enabled=false to stop capturing it. The CDP categories (console, network, page, interaction), screenshot and platform are off by default and are opt-in: set enabled=true to capture them.
      - `captcha` BrowserTelemetryCategoryConfig — Per-category telemetry configuration.
        - `enabled` boolean — Whether this category is captured. Operational categories (control, connection, system, captcha) default to true; set false to opt out. CDP categories (console, network, page, interaction), screenshot and platform default to false; set true to opt in.
      - `connection` BrowserTelemetryCategoryConfig — Per-category telemetry configuration.
        - `enabled` boolean — Whether this category is captured. Operational categories (control, connection, system, captcha) default to true; set false to opt out. CDP categories (console, network, page, interaction), screenshot and platform default to false; set true to opt in.
      - `console` BrowserTelemetryCategoryConfig — Per-category telemetry configuration.
        - `enabled` boolean — Whether this category is captured. Operational categories (control, connection, system, captcha) default to true; set false to opt out. CDP categories (console, network, page, interaction), screenshot and platform default to false; set true to opt in.
      - `control` BrowserTelemetryControlConfig — Configuration for the control category. Same enabled semantics as any other category, plus settings for the browser-control commands the CDP proxy reports.
        - `cdp` BrowserTelemetryCdpControlConfig — Settings for the cdp_command events the CDP proxy reports.
          - `excluded_methods` BrowserCdpCommandMethod[] — Methods to leave out of the cdp_command stream. Omit the list to keep the current one; send an empty list to report every supported method again. Exclusion is a telemetry setting only: an excluded command is still relayed to the browser unchanged, it simply produces no event. Use it to drop the highest-volume methods — Input.dispatchMouseEvent during a humanized cursor path, or Page.captureScreenshot under a screencast — without turning the whole category off. Excluded commands are counted in cdp_disconnect.telemetry_excluded.
        - `enabled` boolean — Whether this category is captured. Control is on by default; set false to opt out.
      - `interaction` BrowserTelemetryCategoryConfig — Per-category telemetry configuration.
        - `enabled` boolean — Whether this category is captured. Operational categories (control, connection, system, captcha) default to true; set false to opt out. CDP categories (console, network, page, interaction), screenshot and platform default to false; set true to opt in.
      - `network` BrowserTelemetryCategoryConfig — Per-category telemetry configuration.
        - `enabled` boolean — Whether this category is captured. Operational categories (control, connection, system, captcha) default to true; set false to opt out. CDP categories (console, network, page, interaction), screenshot and platform default to false; set true to opt in.
      - `page` BrowserTelemetryCategoryConfig — Per-category telemetry configuration.
        - `enabled` boolean — Whether this category is captured. Operational categories (control, connection, system, captcha) default to true; set false to opt out. CDP categories (console, network, page, interaction), screenshot and platform default to false; set true to opt in.
      - `platform` BrowserTelemetryCategoryConfig — Per-category telemetry configuration.
        - `enabled` boolean — Whether this category is captured. Operational categories (control, connection, system, captcha) default to true; set false to opt out. CDP categories (console, network, page, interaction), screenshot and platform default to false; set true to opt in.
      - `screenshot` BrowserTelemetryCategoryConfig — Per-category telemetry configuration.
        - `enabled` boolean — Whether this category is captured. Operational categories (control, connection, system, captcha) default to true; set false to opt out. CDP categories (console, network, page, interaction), screenshot and platform default to false; set true to opt in.
      - `system` BrowserTelemetryCategoryConfig — Per-category telemetry configuration.
        - `enabled` boolean — Whether this category is captured. Operational categories (control, connection, system, captcha) default to true; set false to opt out. CDP categories (console, network, page, interaction), screenshot and platform default to false; set true to opt in.
    - `enabled` boolean — Request shortcut for browser telemetry capture. True enables capture; with no browser category settings it captures the default set (control, connection, system, captcha), and any browser category settings are layered onto that default set. On update, enabled=true resolves the config fresh from the default set plus any provided categories, replacing the session's current selection rather than merging onto it; omit enabled to merge categories onto the current selection instead. False stops capture on update and starts no capture on create. enabled=false cannot be combined with browser category settings.
    - `export` BrowserTelemetryExportRequestConfig — Export destinations for a session's captured telemetry, by protocol. Honored when creating a browser, including the browser a managed auth connection creates for a login. Browser pools do not support export and reject it; on a browser update it is ignored, so the session keeps the destination it was created with.
      - `otlp` BrowserTelemetryOTLPExportRequestConfig — OTLP export settings for a browser session.
        - `destination` union — OTLP destination selection. Provide either id or name. The destination must exist in the project the request resolves to.
          - object
            - `id` string, required — OTLP destination ID
            - `name` string — OTLP destination name
          - object
            - `id` string — OTLP destination ID
            - `name` string, required — OTLP destination name
        - `enabled` boolean — Whether to export captured telemetry over OTLP. Setting destination implies enabled=true, so this only needs to be set explicitly to disable export (enabled=false with a destination is rejected).
  - `proxy` union — Proxy selection. Provide either id or name. The proxy must be in the same project as the resource referencing it. When selecting by name, the name must match exactly one active proxy in the project. Ambiguous names return a 400; use id for stable references.
    - object
      - `id` string, required — Proxy ID
      - `name` string — Proxy name
    - object
      - `id` string — Proxy ID
      - `name` string, required — Proxy name
  - `record_session` boolean — Override the connection's default for recording this login's browser session. When omitted, the connection's record_session default is used.

## Response `200`

Login flow started

- LoginResponse — Response from starting a login flow
  - `flow_expires_at` string, date-time, required — When the login flow expires
  - `flow_type` 'LOGIN' | 'REAUTH', required — Type of login flow started
  - `handoff_code` string — One-time code for handoff (internal use)
  - `hosted_url` string, uri, required — URL to redirect user to for login
  - `id` string, required — Auth connection ID
  - `live_view_url` string, uri — Browser live view URL for watching the login flow

## Other responses

- `400` — Bad Request – invalid input
- `401` — Unauthorized – missing or invalid authorization token
- `403` — Forbidden – insufficient permissions or plan
- `404` — Resource not found
- `409` — Login flow already in progress
- `500` — Internal Server Error

---

[API](https://skmtc.net/onkernel/apis/kernel-api.md) · [All operations](https://skmtc.net/onkernel/apis/kernel-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/onkernel/kernel-api/revisions/858365328f92/schema)