Skip to main content
Your agent’s browser can sign in to websites in three ways: it restores a browser profile that is already signed in, it types a saved login (username, password, and optional 2FA) that Gumloop fills in for it, or it hands the browser to you to sign in. Saved logins and sensitive handoff fields keep password values out of agent-visible text.
Your Vault page with 1Password, Secrets, Logins, and Browser Profiles sections, showing one saved login and a Default browser profile

Logins and Browser Profiles in the Vault.

​
User-owned or agent-owned: Whose accounts does the agent use?

Two settings on this page, Browser profile and 1Password, ask the same question: when someone runs the agent, whose accounts does it use? You answer it with the same choice each time.
Whose profile toggle with User-owned, Everyone uses their own profile, and Agent-owned, Everyone uses the profile you pick

The same choice appears on the Browser profile and 1Password settings.

Everyone acts as themselves. Each person who runs the agent uses their own accounts. If ten people use the agent, it works in ten different accounts. Shown as User/Team-owned on team agents.
  • Browser profile: each person’s own saved sign-ins.
  • 1Password: each person’s own service account.
Use it when people work in their own accounts, for example a research agent your team shares where each person signs in to their own LinkedIn.
Agent-owned works the same way it does for connectors. On organizations it needs the Agent-owned credentials feature on your custom role, and it can’t be used while the agent is shared with Anyone. Choosing Agent-owned on an Anyone-shared agent offers to change its sharing first.

​
Logins

A login is a website username, password, and optional 2FA authenticator key, stored encrypted in your Vault. When the agent signs in, it names the login and Gumloop types the values into the page after checking the site. The password and 2FA key never reach the agent or its sandbox environment.

​
How do I add a login?

1

Open your Vault

Go to gumloop.com/personal/vault for your own logins, or your team’s Vault for shared ones. Click Add.
2

Choose Login for a website

Username, password and optional 2FA. The agent types them into the site without seeing them.
What are you adding? dialog with API key or value and Login for a website options
3

Fill in the login

Add Login form with Name, Website, Username, Password, and an Advanced section with Authenticator key and Type the password on
4

Click Create

The login appears under Logins in your Vault.

​
How do I give an agent a login?

In the agent’s Browser section, click + Login. In Add login to agent, choose a Name for the agent to use, then a Source: an Existing login from your Vault, or a New login created on the spot.
Add login to agent dialog with Name, Source with Existing login and New login, and a Login picker
Gumloop also lists the agent’s logins in its instructions, so the agent knows which sites it can sign in to and as which username. A binding you remove is revoked from the next turn, even in a running chat.

​
Where can a login be typed?

Every fill is checked before anything is typed. The page field’s scheme and port must match the login’s website, and its host must match the Type the password on setting: The check uses the frame the field actually lives in, not just the top page, so a login form embedded from another site is refused. Shared hosting domains such as github.io or herokuapp.com count each subdomain as its own site, so a login for alice.github.io never types on bob.github.io. This applies to saved passwords only. Card numbers and codes you provide in a browser handoff can go into a payment frame embedded in the site’s page. If the check fails, nothing is typed and the agent is told to ask you with a handoff instead.

​
How do I save a login from a handoff?

When you enter a new username and password in a handoff card, tick Save login for <site> before you click Continue. If the agent is in a team, choose who can use it: Only me or My team. Gumloop saves the login to the chosen Vault so the agent can use it on later sign-ins.

​
Can I reuse a saved secret in a handoff?

Choose Existing > Select a secret in a sensitive field to reuse a saved secret. The picker includes personal and team Vault secrets you can access, not saved website logins or connector credentials. If you select a secret for the password, Save login is not offered. Gumloop keeps the selected value out of the transcript and types it only on the host shown in the handoff. See Agent browser.

​
Browser profiles

A browser profile is how the agent’s browser remembers which websites it is signed in to. It works like your own Chrome: sign in to a site once, and next time you open the browser you are still signed in. Without a profile, every task would start with a fresh browser that is signed out of everything.

​
How does a profile keep the agent signed in?

1

The agent signs in once

It signs in with a saved login, or you sign in for it with a handoff.
2

Gumloop saves the sign-in

At the end of the agent’s turn, the sign-in is saved to the browser profile.
3

The next task starts signed in

The next time the agent opens the browser, even in a brand-new chat, it is already signed in to that site.
You do not need to set anything up. Your personal Default profile is created automatically the first time a task saves a sign-in.

​
What’s the difference between a profile and a login?

They work best together. The profile keeps the agent signed in from task to task. When a site eventually signs it out, the agent uses the login to sign back in, and the profile saves the new session.

​
Who owns a browser profile?

A profile belongs to a person or a team, never to an agent. An agent that uses a profile can use every site that profile is signed in to.

​
Can everyone who runs the agent share one profile?

Yes, with Agent-owned. By default the profile is User-owned, so everyone uses their own sign-ins. To change it, click Browser profile in the agent’s Browser section and pick an option under Whose profile. See User-owned or Agent-owned for which to pick.
  • User-owned: Everyone uses their own profile. Each person’s Personal default profile is used.
  • Agent-owned: Everyone uses the profile you pick. Picking a profile under Profile switches the agent to Agent-owned.
Incognito chats never restore or save a profile.

​
How do I import my sign-ins from my browser?

Sign in to the site in Chrome on your computer, then import that session. The agent then opens the site already signed in. This also helps when a site won’t let the cloud browser sign in, for example SSO that requires a check on your registered device.
1

Open Browser profile

In the agent’s Browser section, click Browser profile.
Agent Browser section with the Browser toggle on, Proxy, Browser profile set to User-owned, and 1Password
2

Click Import from browser

Open the three-dot menu to the right of Profile and click Import from browser.
Browser profile settings with the Profile menu open, showing Import from browser and Manage browser profiles
3

Click Preview

In the Import logins dialog, click Preview. If you see Install the Gumloop extension to import your logins, install the Gumloop Chrome extension first, then come back.
4

Pick the sites and click Import

Tick the sites you want (or Select all) and click Import. With a long list, type part of a domain in the search box above the site list to filter it. Select all and Select none apply to the sites that match the search, sites you already ticked stay selected when you change the search, and Import brings in every ticked site.
With User-owned, the sign-ins go into your Personal default profile. With Agent-owned, they go into the profile the agent uses, and the dialog title shows its name. You can also open Import logins from your Vault: click Add on the Browser Profiles row, or Import in a profile’s menu.
The Import logins dialog also shows a terminal command. Copy it and run it on your computer. macOS may ask for Keychain access. Windows isn’t supported yet.
Terminal
With the Gumloop CLI installed, run the import directly:
Terminal
List your profiles with gumloop browser profiles list (add --team <team_id> for a team’s).
Use Import cookies, and list profiles with List browser profiles.
  • Imports bring cookies only, not local storage.
  • One import can carry up to 20,000 cookies. A profile holds up to 25,000 cookies or 24 MB.
  • Importing while a task is running is safe: the import and the task’s save are merged.
  • Only people who manage team secrets can import into a team profile. Only a personal profile’s owner can import into it.

​
How do I manage profiles?

Open the Browser Profiles section of your Vault, or click Manage browser profiles in the agent’s Profile menu. Each profile’s menu has Import, Rename, Make default (personal profiles), and Delete. In a team’s Vault, Add creates a new empty profile for the team. When an agent switches profiles, or its profile is deleted, the browser is reset before the next step so no session carries over from one profile to another.

​
1Password

Connect 1Password and the agent can sign in with the logins in your 1Password vaults, including 2FA codes. You don’t copy anything into Gumloop, and the agent never sees the passwords.

​
How does 1Password work with the agent?

1

Gumloop lists the logins it may use

The first time the agent uses its browser in a turn, Gumloop reads the list of Login items in the vaults you allowed. It reads only each item’s title and website, never the password.
2

The agent searches for the right login

The agent searches that list for the site it is on, for example github.com, and finds the matching item.
3

Gumloop types it in

Gumloop fetches just that one item from 1Password and types the username, password, and current 2FA code into the page, after checking it is the item’s site. 1Password logs each read.

​
How do I set up 1Password?

1

Prepare a vault in 1Password

1Password service accounts can’t see Private vaults, so give agents a vault of their own, such as Gumloop Agents. Add the logins agents need. Each login needs its website filled in, plus 2FA where the site asks for it.
2

Create a service account

In 1Password Developer Tools, create a Service Account with read-only access to that vault. Copy the ops_ token. 1Password shows it only once.
3

Connect it in Gumloop

In your Vault (or your team’s Vault), click Add on the 1Password row and paste the token.
4

Turn it on for the agent

In the agent’s Browser section, open 1Password and click Turn on under Use 1Password. The agent’s Browser must be on first.
5

Choose whose service account and which vaults

Whose service account: User-owned uses each person’s own default service account (or the team’s default on team agents); Agent-owned uses one service account you pick for everyone. See User-owned or Agent-owned.Vaults: All vaults the service account can read, or up to 10 specific vaults.
Gumball needs no setup. Once you connect 1Password, it can use every vault your default connection can read.

​
How does the agent find the right login?

Each 1Password Login item becomes a login named OP_<TITLE>, for example OP_GITHUB. The agent finds items by searching: A login named “GitHub” but saved for a different website does not match a github.com search, because matching uses the item’s website, not its title.

​
What are the 1Password limits?

​
What else should I know?

  • If 1Password is unavailable or rate-limits the service account, that turn runs without 1Password logins and the task continues.
  • If a Vault login and a 1Password item have the same name, the Vault login is used. Two 1Password items with the same title get _2, _3, and so on.
  • Keep agent vaults small. An agent can sign in with any login in the vaults you give it.
  • Agent-owned 1Password is not used while the agent is shared with Anyone.

​
FAQ

The page failed the site check. Common causes: the login is set to This exact address only and the form is on another subdomain (for example login.acme.com), the form is inside an embedded frame from a different site, or the scheme or port differs. Edit the login and set Type the password on to Any page of this site, or let the agent ask you with a handoff.
Only authenticator-app codes can be generated automatically, from the login’s Authenticator key. For codes sent by SMS or email, the agent hands the browser to you with a one-time code field.
Edit the login in the Vault. Leave Password or Authenticator key blank to keep the current value.
Not with the default User-owned setting: each person uses their own profile and their own logins. With an Agent-owned profile or a team login, everyone who runs the agent uses the same sessions or credentials.
An agent-owned profile stays pinned even after it is deleted, so the browser starts signed out rather than silently using someone else’s sessions. Pick a new profile, or switch Whose profile back to User-owned.
Check that you imported into the profile the agent uses (see Browser profile in the agent’s Browser section), and that the site’s session had not expired in your own browser. Some sites also tie sessions to local storage, which imports do not copy. In that case, save a login so the agent can sign in itself.

Agent browser

Turn on the browser, watch it live, replay steps, and answer handoffs.

Code sandbox & secrets

The Vault, secrets, and the sandbox the browser runs in.

CLI

Install the Gumloop CLI to import sign-ins from your terminal.

Custom roles

Control who can give agents a browser.