auth_update_profile
Create or update an authentication profile for visual QA testing. Configure tokens, cookies, OAuth, or storage to access protected pages before capturing screenshots.
Instructions
Create or update an auth profile. Only the fields you pass change (dicts are merged).
Any secret may be given as "env:VAR_NAME" so it is read from the server's environment instead of passing through the conversation — prefer that.
origins: origins that receive headers/tokens, e.g. ["https://app.example.com"] (default: the base_url's origin). Credentials are never sent to other origins. access_token/token_type/expires_in/refresh_token: a bearer token you already have. apply_token_as: where the app expects the token — any of "header" (Authorization: Bearer), "header:X-Api-Key", "local_storage:", "session_storage:", "local_storage_json:" (whole token object as JSON), "cookie:". oauth: {grant_type: client_credentials|password|refresh_token|authorization_code, token_url, client_id, client_secret, scope, audience, username, password, authorize_url, redirect_uri, client_auth: post|basic, extra_params}. For client_credentials/password a token is fetched immediately and refreshed automatically. For authorization_code, call auth_oauth_login next. cookies: Playwright cookies [{name, value, url} or {name, value, domain, path}]. local_storage/session_storage: {origin: {key: value}} injected before page scripts run. http_credentials: {username, password} for HTTP basic auth. clear: field names to remove, e.g. ["token", "cookies", "storage_state"].
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | ||
| clear | No | ||
| oauth | No | ||
| cookies | No | ||
| headers | No | ||
| origins | No | ||
| expires_in | No | ||
| token_type | No | ||
| access_token | No | ||
| local_storage | No | ||
| refresh_token | No | ||
| apply_token_as | No | ||
| session_storage | No | ||
| http_credentials | No |