Devin signs in once and remembers. Build a QA agent that tests behind your login with the Claude Agent SDK
What Devin does with browser logins Devin is Cognition's AI software engineer ( Cognition ). Most web apps worth testing sit behind a login, and Devin's docs describe how it gets past one without asking every time ( Devin docs ): A person logs in once through Devin's interactive browser, in the session's Desktop tab, and handles SSO redirects, MFA prompts and CAPTCHAs themselves. When they ask…
The article explains how to create a QA agent that automatically logs into web applications behind login pages using the Claude Agent SDK and Burrowbox. Key points include:
1. Devin, Cognition's AI software engineer, can log into web applications without repeatedly prompting for credentials. It saves browser cookies, MFA prompts, and other profile data to a "blueprint" so the next session starts signed in. Profiles are shared organization-wide.
2. To build the QA agent, you first create a Burrowbox machine with browser mode set to "full" so it keeps sign-in sessions even after restarts. The machine is configured with a short TTL (30 minutes) so state is automatically cleared after the session.
3. A staging test account is added to the machine's encrypted vault. The browser_login tool can then fill in the login form and TOTP codes without exposing passwords directly to the model. The credentials are kept in the vault and loaded when needed.
4. The QA agent is implemented with the Claude Agent SDK in Node.js. It starts the Burrowbox machine, waits for it to be "running", then executes a checklist: opening the app, verifying a project exists, checking settings, and creating a new test project. The agent can automatically handle re-login if needed.
5. The agent is executed in CI, leveraging the machine's persistent cookies and signed-in state across runs. It provides automated end-to-end testing of web apps without manual login steps, improving testing efficiency.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
