> ## Documentation Index
> Fetch the complete documentation index at: https://tbd-6fc993ce-hypeship-update-create-pool-guidance.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Managed Auth

Manage [managed auth](/auth/managed-auth) connections, stored credentials, and external credential providers from the CLI. For authenticating the CLI itself (login, logout, API keys), see [Authentication](/reference/cli/auth).

## Connections

A Managed Auth connection saves a domain's authentication state to a [profile](/browsers/profiles) so future browsers can reuse it. Eligible credential-based flows can reauthenticate automatically. See [Managed Auth](/auth/managed-auth) for concepts and the [programmatic flow](/auth/programmatic) for the SDK equivalent.

### `kernel auth connections create`

Create a managed auth connection for a profile and domain.

| Flag | Description |
| - | - |
| `--profile-name <name>` | Name of the profile to manage (required). |
| `--domain <domain>` | Target domain for authentication (required). |
| `--allowed-domain <domain>` | Additional allowed domains (repeatable). |
| `--login-url <url>` | Login page URL to skip discovery. |
| `--health-check-interval <seconds>` | Seconds between health checks (300–86400). |
| `--no-health-checks` | Disable periodic health checks. |
| `--no-auto-reauth` | Disable automatic reauthentication attempts after an expired session is detected. |
| `--region <region>` | Browser region for login, health-check, and reauthentication sessions: `us-east`, `eu-west`, or `ap-southeast`. Defaults to `us-east`. |
| `--proxy-id <id>` | Proxy ID to use. |
| `--proxy-name <name>` | Proxy name to use. |
| `--credential-provider <name>` | External credential provider name. |
| `--credential-name <name>` | Kernel credential name to use. |
| `--credential-path <path>` | Provider-specific path (e.g. `VaultName/ItemName`). |
| `--credential-auto` | Look up the credential by domain from the provider (defaults to true when `--credential-provider` is set without `--credential-path`). |
| `--no-save-credentials` | Don't save credentials after a successful login. |
| `--telemetry <spec>` | Set default browser telemetry for this connection: `all`, `off`, or a comma-separated category list like `console,network`. |
| `--output json`, `-o json` | Output raw JSON object. |

### `kernel auth connections list`

List managed auth connections.

| Flag | Description |
| - | - |
| `--domain <domain>` | Filter by domain. |
| `--profile-name <name>` | Filter by profile name. |
| `--limit <n>` | Maximum number of results to return. |
| `--offset <n>` | Number of results to skip. |
| `--output json`, `-o json` | Output raw JSON array. |

### `kernel auth connections get <id>`

Get a managed auth connection by ID.

| Flag | Description |
| - | - |
| `--output json`, `-o json` | Output raw JSON object. |

### `kernel auth connections login <id>`

Start a login flow and return a hosted URL for authentication.

| Flag | Description |
| - | - |
| `--region <region>` | Region override for this login only. Omit it to inherit the connection region. |
| `--proxy-id <id>` | Proxy ID to use for this login. |
| `--proxy-name <name>` | Proxy name to use for this login. |
| `--telemetry <spec>` | Override telemetry for this login only, merged with the connection's config. Pass `all`, `off`, or a comma-separated category list like `console,network`. |
| `--output json`, `-o json` | Output raw JSON object. |

### `kernel auth connections submit <id>`

Submit field values to an in-progress login flow. Use `kernel auth connections follow <id>` to stream progress.

| Flag | Description |
| - | - |
| `--field-value <id=value>` | Canonical field ID/value pair from the connection's `fields` list (repeatable). Prefer this over `--field`. |
| `--choice-id <id>` | Canonical choice ID from the connection's `choices` list. |
| `--field <name=value>` | Legacy field name/value pair (repeatable). Prefer `--field-value`. |
| `--mfa-option-id <id>` | MFA option ID when an MFA method was selected. |
| `--sign-in-option-id <id>` | Sign-in option ID when the flow returned non-MFA choices. |
| `--sso-button-selector <xpath>` | XPath selector when choosing an SSO button. |
| `--sso-provider <provider>` | SSO provider when choosing by provider (e.g. `google`, `github`). |
| `--output json`, `-o json` | Output raw JSON object. |

```bash theme={null}
# Submit username and password
kernel auth connections submit <id> --field username=myuser --field password=mypass

# Select an MFA option
kernel auth connections submit <id> --mfa-option-id <id>
```

### `kernel auth connections follow <id>`

Stream real-time login flow state updates over SSE.

| Flag | Description |
| - | - |
| `--output json`, `-o json` | Output raw JSON events. |

### `kernel auth connections timeline <id>`

List the connection's login, reauthentication, and health-check events, most recent first.

| Flag | Description |
| - | - |
| `--type <type>` | Filter to `login`, `reauth`, or `health_check`. |
| `--page <n>` | Page number, 1-based (default: `1`). |
| `--per-page <n>` | Items per page (default: `20`). |
| `--output json`, `-o json` | Output a JSON object containing `events`, `page`, `per_page`, and `has_more`. |

```bash theme={null}
kernel auth connections timeline auth_01k3m8v2c9w4n7q6 --type reauth --page 1 --per-page 20
```

### `kernel auth connections update <id>`

Update connection settings such as login URL, health checks, credential source, and proxy.

| Flag | Description |
| - | - |
| `--login-url <url>` | Login page URL (set to an empty string to clear). |
| `--allowed-domain <domain>` | Additional allowed domains (replaces the existing list). |
| `--health-check-interval <seconds>` | Seconds between health checks. |
| `--health-checks` / `--no-health-checks` | Enable or disable periodic health checks. |
| `--auto-reauth` / `--no-auto-reauth` | Enable or disable automatic reauthentication attempts after an expired session is detected. |
| `--region <region>` | Region for browser sessions created after the update: `us-east`, `eu-west`, or `ap-southeast`. Active sessions don't move. |
| `--proxy-id <id>` | Proxy ID to use. |
| `--proxy-name <name>` | Proxy name to use. |
| `--credential-provider <name>` | External credential provider name. |
| `--credential-name <name>` | Kernel credential name to use. |
| `--credential-path <path>` | Provider-specific path (e.g. `VaultName/ItemName`). |
| `--credential-auto` | Look up the credential by domain from the provider. |
| `--save-credentials` | Save credentials after a successful login. |
| `--no-save-credentials` | Don't save credentials after a successful login. |
| `--telemetry <spec>` | Update telemetry for future browser sessions: `all`, `off`, or a comma-separated category list like `console,network`. |
| `--output json`, `-o json` | Output raw JSON object. |

### `kernel auth connections delete <id>`

Delete a managed auth connection.

| Flag | Description |
| - | - |
| `--yes`, `-y` | Skip the confirmation prompt. |

## Credentials

Store login field values, TOTP secrets, and SSO settings that managed auth connections use to authenticate. See [Credentials](/auth/credentials) for concepts.

### `kernel credentials create`

Create a new credential.

| Flag | Description |
| - | - |
| `--name <name>` | Unique name for the credential (required). |
| `--domain <domain>` | Target domain this credential is for (required). |
| `--value <name=value>` | Field name/value pair (repeatable, e.g. `--value username=myuser --value password=mypass`). |
| `--totp-secret <secret>` | Base32-encoded TOTP secret for 2FA. |
| `--sso-provider <provider>` | SSO provider (e.g. `google`, `github`, `microsoft`). |
| `--output json`, `-o json` | Output raw JSON object. |

### `kernel credentials list`

List credentials.

| Flag | Description |
| - | - |
| `--domain <domain>` | Filter by domain. |
| `--limit <n>` | Maximum number of results to return. |
| `--offset <n>` | Number of results to skip. |
| `--output json`, `-o json` | Output raw JSON array. |

### `kernel credentials get <id-or-name>`

Get a credential by ID or name.

| Flag | Description |
| - | - |
| `--output json`, `-o json` | Output raw JSON object. |

### `kernel credentials update <id-or-name>`

Update a credential.

| Flag | Description |
| - | - |
| `--name <name>` | New name for the credential. |
| `--value <name=value>` | Field name/value pair to update (repeatable). |
| `--totp-secret <secret>` | Base32-encoded TOTP secret (set to an empty string to remove). |
| `--sso-provider <provider>` | SSO provider (set to an empty string to remove). |
| `--output json`, `-o json` | Output raw JSON object. |

### `kernel credentials totp-code <id-or-name>`

Print the current TOTP code for a credential.

| Flag | Description |
| - | - |
| `--output json`, `-o json` | Output raw JSON object. |

### `kernel credentials delete <id-or-name>`

Delete a credential by ID or name.

## Credential providers

Connect an external secrets manager (e.g. 1Password) so managed auth connections can look up credentials at login time instead of storing them in Kernel.

### `kernel credential-providers create`

Register a new credential provider.

| Flag | Description |
| - | - |
| `--provider-type <type>` | Provider type (e.g. `onepassword`). |
| `--name <name>` | Human-readable name for this provider instance. |
| `--token <token>` | Service account token for the provider. |
| `--cache-ttl <seconds>` | How long to cache credential lists (default: 300). |
| `--output json`, `-o json` | Output raw JSON object. |

### `kernel credential-providers list`

List credential providers.

| Flag | Description |
| - | - |
| `--output json`, `-o json` | Output raw JSON array. |

### `kernel credential-providers get <id>`

Get a credential provider by ID.

| Flag | Description |
| - | - |
| `--output json`, `-o json` | Output raw JSON object. |

### `kernel credential-providers list-items <id>`

List items available from a credential provider.

| Flag | Description |
| - | - |
| `--output json`, `-o json` | Output raw JSON array. |

### `kernel credential-providers test <id>`

Test the connection to a credential provider.

| Flag | Description |
| - | - |
| `--output json`, `-o json` | Output raw JSON object. |

### `kernel credential-providers update <id>`

Update a credential provider.

| Flag | Description |
| - | - |
| `--name <name>` | New human-readable name. |
| `--token <token>` | New service account token (to rotate credentials). |
| `--cache-ttl <seconds>` | How long to cache credential lists. |
| `--enabled` | Whether the provider is enabled for credential lookups. |
| `--priority <n>` | Priority for credential lookups (lower numbers are checked first). |
| `--output json`, `-o json` | Output raw JSON object. |

### `kernel credential-providers delete <id>`

Delete a credential provider.