2FA

Handle two-factor authentication in API V4 runs.

Use the agent’s inbox for email codes, reuse a logged-in profile, or pause for a human. These paths do not require Browser Use to store a TOTP seed.

Let the agent read email codes

Set agentmail on an API V4 run to provision an inbox for its workspace. The inbox address and email skill are added to the agent’s context, so it can receive the message, read the code, and finish the browser flow:

Python

run = client.runs.create(
    "Create an account at example.com with your inbox. Read the verification email and enter its code.",
    agentmail=True,
)
result = client.runs.wait_for_completion(run.id)

The inbox persists with the workspace. For each API follow-up that needs inbox access, pass agentmail=true again and reuse the same session. Its address is also shown under Settings → Workspaces. For an existing account, start one AgentMail-enabled run, copy that address, configure email forwarding, then continue the same session with AgentMail enabled.

Python

inbox_run = client.runs.create(
    "Open example.com and stop while I configure email forwarding to your inbox.",
    agentmail=True,
)
client.runs.wait_for_completion(inbox_run.id)

follow_up = client.runs.create(
    "Check the inbox again and finish verification",
    session_id=inbox_run.session_id,
    agentmail=True,
)

Forward SMS codes to the inbox

If a site only sends codes by SMS, you can use your own phone automation or forwarding provider to email those messages to the workspace inbox. Then tell the agent to read the forwarded message and enter its code.

SMS forwarding is a customer-managed pattern, not a built-in Browser Use integration. Browser Use does not read your phone or mobile account. Limit forwarding to the intended sender and treat verification codes as sensitive.

Reuse a logged-in profile

Sync your local login, then load that profile in the run:

Python

run = client.runs.create(
    "Download my latest invoice",
    browser_settings={"profileId": "YOUR_PROFILE_ID"},
)

This avoids another 2FA challenge while the site’s cookies remain valid.

Let a human take over

Ask the first run to stop at the 2FA screen, get its live_view_url from the browser.ready event, and have the user enter the code. Then continue with the same session:

Python

first = client.runs.create(
    "Open the login page and stop at the 2FA prompt",
)
client.runs.wait_for_completion(first.id)

next_run = client.runs.create(
    "Continue after login and download the invoice",
    session_id=first.session_id,
)

See Human in the loop for retrieving and embedding the live browser URL. Never put passwords or TOTP secrets directly in a prompt.