Docs · Autopilot
Products behind a login
Most of what your users do happens after they sign in. Autopilot signs in the same way, walks the product like a new user, and scores every screen it reaches. This page is the whole story of that sign-in: which path to pick, what happens with 2FA and captchas, what Autopilot never does, and what to do when a session expires.
No login saved? Autopilot still runs: it opens the product as a visitor and walks everything a visitor can reach. A product that asks for a sign-in on its first screen ends the run with a note that points here, so nothing is ever scored on a login wall.
Which path to pick
Start from the top. The first one that fits your login is the one to use.
- 1
Test account
- When:
- The login form takes an email and a password, with no captcha. 2FA through an authenticator app is fine.
- How:
- Product → Settings → Login for scans → Test account. Give the login page URL, the email and the password. If the account uses an authenticator app, paste the setup key shown next to the QR code (or the otpauth link) too: Autopilot types the six-digit code itself. Corexi fills the form before every run.
- Note:
- Best for unattended runs: nothing expires. Codes sent by SMS or email cannot be automated; see the third path.
- 2
Ready session
- When:
- The login has a captcha, a bot check, single sign-on, or a code by SMS or email. Works with every product.
- How:
- Product → Settings → Login for scans → Change → Ready session. Sign in to your product as usual (with 2FA) in your own browser, open the developer console on that tab (F12 → Console), run the snippet shown on the card, paste the result into the card, save.
- Note:
- The snippet copies the browser's session for your product only: its cookies and local storage. Nothing else on your machine is read.
- 3
Verification code, handed to you
- When:
- A test account works but the product asks for a code by SMS or email after the password.
- How:
- Autopilot stops at the code screen, emails you, and shows the live screen. You type the code in the live view and press Resume; the run continues.
- Note:
- Someone has to be there when the run starts. For unattended, scheduled runs use a ready session or an account without the code.
2FA, captchas and bot checks
Corexi does not try to get past a captcha or a bot check, and it does not guess verification codes. The one code it can produce is an authenticator app's: save the test account's authenticator secret with the password and Autopilot types the current six-digit code at the 2FA screen, the same way the app on your phone would. When a test account meets a captcha or a code it cannot produce, the card in Settings says so and offers the ready-session path. A ready session is the browser state of someone who already signed in, so the product treats Autopilot as that signed-in person and never shows the challenge.
If your product can exempt one account from captchas (many B2B products can, per user or per IP), a test account is the least work over time: nothing expires, and 2FA by authenticator app is no obstacle.
What Autopilot never does
It behaves like a careful new colleague on their first day: it looks, clicks, fills forms with sample values, and reads. It never:
- pay, check out, or enter card details (payment flows stay off unless you turn them on for a sandbox)
- delete anything, or confirm a deletion dialog
- invite people, change roles, or send messages from your product
- sign out, change the password, or touch security settings
- solve captchas or bot challenges
- leave your product's domain
Use a test account or a test workspace, not a real employee's account: Autopilot does create draft records where a form allows it (an employee, a request), so the data it leaves behind should be test data.
When a session expires
Sessions expire on the product's own schedule: hours for some, weeks for others. When Autopilot opens the product and lands on the login screen instead:
- The card in Settings turns red and says what happened.
- You get one email with the snippet to run and where to paste the result.
- Scheduled runs wait; nothing is scored with a broken login, so your findings never fill with sign-in screens.
- Paste a fresh session and the next run picks it up.
Where the login lives
Credentials and sessions are encrypted at rest with a key that only the scanner holds, decrypted in memory for the run, never written to logs, never shown again in the interface. Remove the login from Settings and it is gone.
Ready to try it
We add your product with you, save the login together, and you watch the first run live. 14-day free trial, no card.