Log in with 2FA

Axiom can complete two-factor authentication (2FA) automatically, with no human involvement, so logins protected by 2FA can run unattended in the cloud.

A 2FA login always starts with a normal sign-in, so you log in first and then handle the code. We recommend signing in with saved credentials, because the same credential also stores your 2FA secret, so one setup covers the whole login. How you handle the code then depends on the kind of 2FA the site uses:

  • Authenticator-app codes (the 6-digit codes from an app like Google Authenticator or 1Password) are handled fully automatically. Axiom generates the current code at runtime. This is the recommended approach — see automatic authenticator codes below.
  • Codes sent by SMS or email can be delivered to a running automation with a single API call. See codes sent by SMS or email.
  • For sites that use a method Axiom can't automate, you can still run attended on the desktop app and enter the code yourself.

For other login methods, see Google Sheet steps, sessions, saved credentials, password managers, or keeping login data on your network.

Automatic authenticator (TOTP) codes

When a site uses an authenticator app for 2FA, it relies on a shared secret (sometimes called a "setup key") to produce a new 6-digit code every 30 seconds. Axiom stores that secret securely and generates the current code at runtime, exactly as your phone would, then types it into the verification field. Nothing is entered by hand, so the whole login runs unattended.

To set this up you:

  1. Save your login as a credential, including its 2FA secret (see below).
  2. Add two steps to your automation: one to sign in, and one to generate the code.

Save your 2FA secret

Save your login on the Log in with saved credentials page and fill in the 2FA secret field. Both the Axiom and 1Password providers support 2FA secrets — with 1Password, the secret comes from the one-time password field on the vault item.

Where to find the 2FA secret: when you turn on 2FA on a site, it shows a QR code. Look for a link such as "setup key" or "enter the code manually" and copy the key it reveals — that's the secret to paste into the 2FA secret field. Copy it during the initial setup, before you verify the first code. If you ask the site for a key again after verifying, it may issue a fresh one that no longer matches, and the codes Axiom generates won't be accepted.

Build an unattended login

Two steps work together to sign in and clear the 2FA prompt:

The full recipe is:

  • 1 Go to page (the login page)
  • 2 Log in with credentials
  • 3 Click element (sign in, if needed)
  • 3 Generate authenticator code
  • 4 Enter text totp-code (into the verification field)
  • 5 Click element (submit, if needed)

To build it:

  1. Add a Go to page step and set its URL to the sign-in page.
  2. Add a Log in with credentials step. Choose your saved credential, then select the username and password fields on the page. The site redirects to its 2FA verification page.
  3. Add a Click element step for the sign in button. Some sites sign in as soon as the password is entered, so this step may not be needed.
  4. Add a Generate authenticator code step and choose the same credential.
  5. Add an Enter text step. Select the verification code field, click Insert data, and choose the [totp-code] token.
  6. Add a Click element step for the submit button. Some sites (for example GitHub) accept the code as soon as it's typed, so this step may not be needed.

Tip: the verification field on many sites only auto-accepts a code when it's typed with a small delay between key presses. The Enter text step now defaults to a 10ms delay, which works well. If a code isn't accepted, check that this delay is set.

Run the automation in the cloud and it signs in, generates the code, and submits it, all on its own.

Skip repeat 2FA prompts

Many sites issue a "remember this device" cookie after a successful 2FA login. Turn on Store cookie on the Go to page step so later cloud runs reuse that session and skip the 2FA prompt entirely, until the cookie expires. See storing cookies for more.

Codes sent by SMS or email

Some sites send a one-time code to your phone or email instead of using an authenticator app. Because Axiom can't generate these from a secret, you deliver them to the running automation with an API request.

Add a Wait for 2FA code step where the site asks for the code. The automation pauses there and waits. When the code arrives on your phone or in your inbox, you send it to Axiom with a single API call, and it becomes the [two-factor-code] token for a following Enter text step.

This method:

  • Runs in the cloud only, because it relies on an API request.
  • Requires a Pro plan or higher.
  • Waits for a configurable timeout (120 seconds by default) and fails with a clear message if no code arrives in time.

See the Wait for 2FA code step for the request format and full details.

Attended 2FA (for special cases)

If a site uses a 2FA method none of the above can handle, you can still complete it by hand. Run the automation in the desktop app and add a Wait step before the 2FA prompt to give yourself time to enter the code. This is known as attended automation, because a person has to be present at the start of the run. It can't be used for fully scheduled cloud runs.

Previous
Log in with saved credentials
Next
Log in using a password manager
On this page