Authenticate to a website via Okta SSO and persist the session.

Launches a headless browser, navigates to the target URL, performs Okta login (including TOTP MFA if configured), and saves the browser session for later use. Sessions are stored per-domain in ~/.okta-auth/sessions/.

Credentials are resolved in order: explicit parameter → environment variable → OS keyring when the local provider is set to keyring. When the provider is set to op, launch the server through op run so the environment is populated at process start.

Args: url: Target URL to authenticate against (e.g., 'https://portal.company.com'). username: Okta username or email. Falls back to OKTA_USERNAME or stored keyring data. password: Okta password. Falls back to OKTA_PASSWORD or stored keyring data. totp_secret: Base32 TOTP secret for automated MFA. Falls back to OKTA_TOTP_SECRET or stored keyring data. headed: Show the browser window during login. Set to true for debugging. timeout_ms: Maximum time in ms to wait for page loads (5000-300000, default 60000).

Returns: JSON: {"success": bool, "domain_key": str|null, "message": str, "url": str}

Verify if a stored session for a URL is still valid.

Launches a headless browser with the stored session cookies, navigates to the URL, and checks whether the session is still authenticated (not redirected to Okta login).

Args: url: URL to verify session against. Must match the URL used during login. timeout_ms: Maximum time in ms to wait for page load (5000-120000, default 30000).

Returns: JSON: {"valid": bool, "domain_key": str|null, "message": str, "url": str}

List all stored authentication sessions.

Returns metadata for every saved session including the domain, when it was saved, and cookie/origin counts. Does NOT verify if sessions are still valid — use okta_check_session for that.

Returns: JSON: {"count": int, "sessions": [{url, domain_key, saved_at_iso, cookie_count, origin_count}]}

Delete a stored session for a given URL.

Removes the session file and metadata from ~/.okta-auth/sessions/. The agent will need to re-authenticate to access the service again.

Args: url: URL whose stored session should be deleted.

Returns: JSON: {"deleted": bool, "message": str, "url": str}

Retrieve cookies from a stored session.

Returns the raw cookie data from a stored Playwright session. Useful for making authenticated HTTP requests without launching a browser.

Args: url: URL whose stored session cookies to retrieve. domain_filter: Optional domain substring to filter cookies (e.g., 'okta.com').

Returns: JSON: {"count": int, "cookies": [{name, value, domain, path, ...}], "url": str} Error: {"error": str, "url": str}