docs(auth): add Fill from Managed Auth how-to by bmsaadat · Pull Request #622 · kernel/docs

bmsaadat · 2026-09-22T21:51:30Z

Adds auth/fill-from-managed-auth, a how-to under Fill from Vault, walking through: log in through Managed Auth, create a credential item that references the connection, attach the vault to a browser, fill. Also cross-links it from the Fill from Vault overview.

Do not merge yet. The page documents the managed_auth credential provider from kernel/kernel#4285, which is not in production. Merge order: API in production, SDK release, then this page.

Open items before it leaves draft:

SDK snippets follow the existing vaults.items call shapes; re-check them against the Stainless preview builds once those build cleanly (the current builds on #4285 hit merge conflicts).
The GitHub login selectors were checked against the live page. The authenticator-code selector in the last step was not, since that page needs a session.
If the provider is still gated per organization at merge time, add an "enabled for your organization" line like the hCaptcha page.

mint broken-links passes locally.

🤖 Generated with Claude Code

Note

Low Risk
Documentation-only changes with no runtime or API code; content targets a provider/API not yet in production per the PR note.

Overview
Adds a new Fill from Managed Auth how-to (auth/fill-from-managed-auth) under the Auth → Fill from Vault nav group, documenting how to reuse Managed Auth–saved credentials via vault items with spec.provider: "managed_auth" and the existing fill operation (GitHub walkthrough, requirements, item status, security, and differences from kernel credential items).

Supporting code snippets cover connection login, credential checks, item creation, navigation, and fill invocation (TypeScript, Python, cURL). docs.json registers the page; auth/fill-from-vault now points readers to Managed Auth reuse in Credential sources.

^{Reviewed by Cursor Bugbot for commit fd10397. Bugbot is set up for automated code reviews on this repo. Configure here.}

Adds a page under Fill from Vault that walks through reusing a credential collected by Managed Auth with the vault fill operation: log in through Managed Auth, create a credential item that references the connection, attach the vault to a browser, and fill. Cross-links it from the Fill from Vault overview. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

mintlify · 2026-09-22T21:51:33Z

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
Kernel	🟢 Ready	View Preview	Oct 2, 2026, 11:14 PM

💡 Tip: Enable Automations to automatically generate PRs for you.

Pre-linked credentials qualify even with save_credentials off, the 409 covers a credential with no values, a deleted connection cannot recover, the fill example narrows to the managed auth state before reading field names, and the TOTP step notes sites that auto-submit the code. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

cursor

Risk assessment: Very Low

I reviewed the diff (9 files, +308/−2). Every change is documentation for the Mintlify site:

New how-to page auth/fill-from-managed-auth.mdx and snippet files with TypeScript, Python, cURL, and an example JSON response.
One cross-link sentence in auth/fill-from-vault.mdx.
A sidebar entry for the new page in docs.json.

No application code, infrastructure, CI, authentication implementation, or agent-instruction files are modified. docs.json only adds the new page to navigation. Code owner review is not required on main.

Approving.

_{Sent by Cursor Automation: Assign PR reviewers}

cursor

Risk assessment: Very Low

Re-checked the current head (d200cc1). The diff is still documentation for the Mintlify site only: a new how-to (auth/fill-from-managed-auth.mdx), six example snippets, one cross-link in auth/fill-from-vault.mdx, and a sidebar entry in docs.json (9 files, +308/−2).

No application code, infrastructure, CI, authentication implementation, or agent-instruction files changed. require_code_owner_review is off on main, and there is no CODEOWNERS file.

This automation already approved this same commit. Risk has not increased, so that approval stands and I am not approving again.

_{Sent by Cursor Automation: Assign PR reviewers}

cursor

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit d200cc1. Configure here.}

- Set timeout_ms to its 30-second maximum in the fill example; the default 10 seconds can be too short for several fields. - Break the submit step's follow-ups into a list (Bugbot). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

cursor

Risk assessment: Very Low

Re-checked head d261821 against the previously approved commit d200cc1. The new commit only edits docs:

Example snippets set timeout_ms to 30000 on the fill call.
The submit step in auth/fill-from-managed-auth.mdx is split into a list, plus one sentence explaining that timeout.

The full diff is still Mintlify documentation: a how-to page, example snippets, one cross-link in auth/fill-from-vault.mdx, and a sidebar entry in docs.json (9 files, +314/−2). No application code, infrastructure, CI, authentication implementation, or agent-instruction files changed. There is no CODEOWNERS file.

Risk has not increased. This automation already approved the PR, so that approval stands and I am not approving again.

_{Sent by Cursor Automation: Assign PR reviewers}

AnnaXWang · 2026-09-25T16:10:40Z

+
+Managed Auth saves the durable fields a user enters during login, such as an email and password, so it can attempt eligible reauthentication later. A credential item backed by a Managed Auth connection lets your application reuse that saved credential with [`fill`](/vaults/fill): your application or agent drives the login form in its own browser session, and Kernel writes the values, without collecting the credential a second time or returning it to your application.
+
+The item stores no values of its own. It reads the connection's saved credential each time you read the item or invoke `fill`, so a password updated through Managed Auth is used immediately.


so a password updated through Managed Auth is used immediately. is confusing! @bmsaadat does this mean "using fill for a password updated through Managed Auth will automatically use the updated value"?

Yes your interpretation is correct! Great catch, will update it to reflect your wording better

Updated in a0950af

AnnaXWang · 2026-09-25T16:13:10Z

+import NavigateGitHubLogin from "/snippets/navigate-github-login.mdx";
+import FillManagedAuthCredential from "/snippets/fill-managed-auth-credential.mdx";
+
+Managed Auth saves the durable fields a user enters during login, such as an email and password, so it can attempt eligible reauthentication later. A credential item backed by a Managed Auth connection lets your application reuse that saved credential with [`fill`](/vaults/fill): your application or agent drives the login form in its own browser session, and Kernel writes the values, without collecting the credential a second time or returning it to your application.


Suggested change

Managed Auth saves the durable fields a user enters during login, such as an email and password, so it can attempt eligible reauthentication later. A credential item backed by a Managed Auth connection lets your application reuse that saved credential with [`fill`](/vaults/fill): your application or agent drives the login form in its own browser session, and Kernel writes the values, without collecting the credential a second time or returning it to your application.

Managed Auth saves the durable fields a user enters during login, such as an email and password, as a credential item. [`fill`](/vaults/fill) allows your application to reuse credentials backed by a Managed Auth connection, even outside of a Managed Auth workflow. With `fill`, your application or agent drives the login form in its own browser session, and Kernel writes the values, without collecting the credential a second time or returning it to your application.

Thanks, this reads a lot better! I took it nearly as-is with one small tweak: the rest of the page uses "credential item" for the vault item you create from the connection, so I said Managed Auth saves the fields "as a credential" to keep the two from blurring together. Your "even outside of a Managed Auth workflow" line is in word for word. Updated in a0950af, happy to adjust if you'd phrase it differently!

AnnaXWang

2 suggestions, otherwise lgtm

- Lead with reusing the credential even outside a Managed Auth workflow, and keep "credential" (what Managed Auth saves) apart from the vault credential item created from the connection. - Say plainly that the next fill uses an updated password automatically. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

cursor

Risk assessment: Very Low

Re-checked head a0950af against the previously reviewed commit d261821. The new commit only rewrites two paragraphs in auth/fill-from-managed-auth.mdx: it clarifies that fill can reuse a Managed Auth credential outside a Managed Auth workflow, and that a later fill picks up a password change automatically.

The full diff is still Mintlify documentation: a how-to page, example snippets, one cross-link in auth/fill-from-vault.mdx, and a sidebar entry in docs.json (9 files, +314/−2). No application code, infrastructure, CI, authentication implementation, or agent-instruction files changed. The main ruleset has require_code_owner_review off, and there is no CODEOWNERS file.

Risk has not increased. This automation already approved the PR, so that approval stands and I am not approving again.

_{Sent by Cursor Automation: Assign PR reviewers}

state.fields is left out of list responses and optional in the SDKs, so the fill snippets read it with a fallback and the page says to read it from the item. The create examples set an optional description, and ready is described as a saved credential with values or a TOTP seed. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

- A save_credentials: false connection can also get a credential linked by updating it, not only at creation. - A credential you name yourself is linked before it holds values, so check has_values or has_totp_secret on it instead of the connection's credential field. - A Managed Auth login never saves a TOTP secret; a totp entry needs one stored through the credentials API, and fill uses the credential's TOTP settings. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

mintlify Bot deployed to staging September 22, 2026 21:51 View deployment

mintlify Bot deployed to staging September 22, 2026 21:59 View deployment

cursor Bot approved these changes Sep 22, 2026

View reviewed changes

bmsaadat marked this pull request as ready for review September 23, 2026 19:19

bmsaadat requested a review from AnnaXWang September 23, 2026 19:19

cursor Bot reviewed Sep 23, 2026

View reviewed changes

Comment thread auth/fill-from-managed-auth.mdx Outdated

mintlify Bot deployed to staging September 25, 2026 15:14 View deployment

cursor Bot reviewed Sep 25, 2026

View reviewed changes

AnnaXWang reviewed Sep 25, 2026

View reviewed changes

AnnaXWang approved these changes Sep 25, 2026

View reviewed changes

mintlify Bot deployed to staging September 25, 2026 16:58 View deployment

cursor Bot reviewed Sep 25, 2026

View reviewed changes

mintlify Bot deployed to staging October 2, 2026 16:26 View deployment

mintlify Bot deployed to staging October 2, 2026 23:14 View deployment


		Managed Auth saves the durable fields a user enters during login, such as an email and password, so it can attempt eligible reauthentication later. A credential item backed by a Managed Auth connection lets your application reuse that saved credential with [`fill`](/vaults/fill): your application or agent drives the login form in its own browser session, and Kernel writes the values, without collecting the credential a second time or returning it to your application.

		The item stores no values of its own. It reads the connection's saved credential each time you read the item or invoke `fill`, so a password updated through Managed Auth is used immediately.

Conversation

bmsaadat commented Sep 22, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mintlify Bot commented Sep 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Risk assessment: Very Low

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Risk assessment: Very Low

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Risk assessment: Very Low

Uh oh!

AnnaXWang Sep 25, 2026

Choose a reason for hiding this comment

Uh oh!

bmsaadat Sep 25, 2026

Choose a reason for hiding this comment

Uh oh!

bmsaadat Sep 25, 2026

Choose a reason for hiding this comment

Uh oh!

AnnaXWang Sep 25, 2026

Choose a reason for hiding this comment

Uh oh!

bmsaadat Sep 25, 2026

Choose a reason for hiding this comment

Uh oh!

AnnaXWang Sep 25, 2026

Choose a reason for hiding this comment

Uh oh!

AnnaXWang left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Risk assessment: Very Low

Uh oh!

This branch was successfully deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

bmsaadat commented Sep 22, 2026 •

edited by cursor Bot

Loading

mintlify Bot commented Sep 22, 2026 •

edited

Loading