When Syndai checks a change to a web app, it opens the app in a browser inside
its sandbox and looks at the pages the change touches. Pages behind a sign-in
are skipped unless Syndai has a way to sign in. A test login gives it one.

## Add a test login

You need to be an owner or admin of the workspace.

1. Open **Connections** in the portal, choose the **Environment** tab and find **Test logins**.
2. Pick the repository and enter the test account's username or email and
   password. If the account uses an authenticator app, add its setup key too.
3. Save. Checks of that repository sign in with it once its `syndai.yaml` has
   login steps (see below). Each check's timeline says whether it signed in.

You can also add one from a run: when a check says **Not signed in**, the
timeline offers **Add a test login** right under that line.

## Use a test account, not a real one

Your app and the coding agent run in the same sandbox, so treat the password
as something they could read. Create an account that exists only for testing,
with test data and no access to real customers or payments. By saving a login
you confirm it is a test account you are allowed to share with Syndai.

Syndai stores the login encrypted, types it only into your app's own sign-in
form, and removes the password from logs, recordings and the run timeline. The
password is never shown again after you save it; you can replace or remove it.

## How signing in works

The coding agent adds a short `test_login` block to your repository's
`syndai.yaml` that tells Syndai which fields to fill and what a signed-in page
looks like. You review it in the pull request like any other change.

If the repository creates its own local test user (a `seed_command` in the same
block), Syndai signs in as that user instead and does not use your saved login.

After a successful sign-in Syndai keeps the browser session for the next check,
so it does not sign in on every run. It signs in fresh when the change touches
sign-in itself.

## What the timeline tells you

- **Signed in** or **Signed in · saved session**: the checked pages include
  the signed-in ones.
- **The login was rejected**: your app refused the account. Syndai stops using
  it until you replace it, so it never locks the account out by retrying.
- **Your app's sign-in service didn't respond**: the app could not reach its
  own sign-in backend. Check that the repository's environment values are set
  in **Connections**.
- **It asked for a code, a CAPTCHA, or another site**: Syndai cannot pass a
  CAPTCHA or sign in through another site (single sign-on). Add the
  authenticator setup key if the code comes from an authenticator app.