# Logins

Logins lets an approved agent sign in to a website using credentials you save in Rukou. The
sign-in tools fill the site's form without returning the saved password to the agent.

Logins must be enabled for your organization. If the page says it is unavailable, use its
support link to ask about access.

## Add a login

1. Open **Logins** in your workspace and select **Add a login** or **Add your first login**.
2. Enter the **Website**, a recognizable **Login name**, your **Username or email**, and
   **Password**.
3. If you want Rukou to generate authenticator codes, add the site's **Authenticator setup
   key**. This is the setup secret, rather than a code that expires after a few seconds.
4. Choose who the login is **Saved for**, and select its **Allowed agents**. You can save it
   without choosing an agent and allow one later.
5. Save and complete the approval steps the app presents.

| Saved for | Access |
|---|---|
| **Only you** | You and your approved agents can use it |
| **Workspace** | Workspace members see its name; admins manage which agents can use it |

A login applies to the sites or sign-in pages shown in its details. Your agent's login list
also reports where it may fill. A saved login does not authorize filling its password on an
unrelated website.

## Set up approvals

When you add your first login, Rukou guides you through **Set up how you approve changes**.
Choose a supported passkey or a recovery key, then confirm your identity with the code sent
to your account email. If you choose a recovery key, store it before continuing.

You use this method when allowing an agent or updating a saved password. **Add a second way
to approve** gives you another way in if your usual device or key becomes unavailable.

A new approval method created after losing your old ones does not automatically open your
old logins. Follow the app's recovery steps and re-enter sign-in details where requested.

## Let an agent sign in

Allow the agent in the login's **Manage agents** section. If its connection still **needs
access**, select **Give access** and approve the handover. Browsing access and access to a
saved login are separate.

Ask your agent:

> Use my saved Research account login to sign in. Ask me for help if the site needs a code
> that I must enter.

The agent lists its available logins with `browser_logins` and signs in with
`action: "sign_in"`. A multi-step form may need another call for each step. It should inspect
the page to confirm the result.

By default, you enter extra codes sent by email or text. The agent requests help, and you
enter the code through [Take control](sessions.md#watch-or-take-control). To allow an agent
to enter such codes, change **Sign-in codes** for that login. This setting does not give the
agent access to your inbox or text messages. Authenticator codes use the setup key saved
with the login.

## Keep a sign-in for another session

After successfully signing in with a saved login, ask the agent to call `browser_session`
with `action: "save"` before stopping. This saves cookies and site storage for logins used
in the session. It does not save the whole browser or unrelated sites.

When a later session signs in with the login, Rukou can restore its saved state. The agent
should check the page: the website may have expired or revoked the sign-in. Stopping alone
saves nothing.

## Update or import logins

Open a login and choose **Update saved sign-in details** after changing a password on the
website. Enter the current username and password. If the login has an authenticator setup
key, enter it again to keep that feature; leaving it empty removes it. Updating the stored
details in Rukou does not change the password on the website.

To import, select **Import from a password manager** in the add panel and choose a Chrome
or Apple Passwords CSV export. Your browser reads the file locally. Select the entries to
add; the export file itself is not uploaded, and selected logins are encrypted before being
saved. Allow agents to use them after import.

The login's **Activity** section, where available, shows its use. **Delete login** prevents
further openings in Rukou and retains its activity history. To revoke a website's existing
signed-in sessions, use that website's account controls too.