docs(auth): add Fill from Managed Auth how-to by bmsaadat · Pull Request #622 · kernel/docs

bmsaadat · 2026-09-22T21:51:30Z

Adds auth/fill-from-managed-auth, a how-to under Fill from Vault, walking through: log in through Managed Auth, create a credential item that references the connection, attach the vault to a browser, fill. Also cross-links it from the Fill from Vault overview.

Do not merge yet. The page documents the managed_auth credential provider from kernel/kernel#4285, which is not in production. Merge order: API in production, SDK release, then this page.

Open items before it leaves draft:

SDK snippets follow the existing vaults.items call shapes; re-check them against the Stainless preview builds once those build cleanly (the current builds on #4285 hit merge conflicts).
The GitHub login selectors were checked against the live page. The authenticator-code selector in the last step was not, since that page needs a session.
If the provider is still gated per organization at merge time, add an "enabled for your organization" line like the hCaptcha page.

mint broken-links passes locally.

🤖 Generated with Claude Code

Note

Low Risk
Documentation-only changes with no application or API code; content describes a gated feature that ships after the related API is in production.

Overview
Adds auth/fill-from-managed-auth, a how-to for reusing Managed Auth–saved credentials with vault fill via credential items with spec.provider: "managed_auth". The page walks through login, verifying a saved connection credential, upserting the vault item, attaching the vault, navigating, and invoking fill (including TOTP and error/status behavior), plus security and comparison with Kernel credential items.

Navigation and cross-links: registers the page under Fill from Vault in docs.json and updates Fill from Vault’s credential-sources section to point readers at Managed Auth reuse instead of collecting again.

Snippets: adds reusable MDX examples (connection login, credential check, item upsert, GitHub navigation, fill invocation, sample item JSON); reuses existing attach-credential-vault.

^{Reviewed by Cursor Bugbot for commit a0950af. Bugbot is set up for automated code reviews on this repo. Configure here.}

Adds a page under Fill from Vault that walks through reusing a credential collected by Managed Auth with the vault fill operation: log in through Managed Auth, create a credential item that references the connection, attach the vault to a browser, and fill. Cross-links it from the Fill from Vault overview. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

mintlify · 2026-09-22T21:51:33Z

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
Kernel	🟢 Ready	View Preview	Sep 25, 2026, 4:58 PM

💡 Tip: Enable Automations to automatically generate PRs for you.

Pre-linked credentials qualify even with save_credentials off, the 409 covers a credential with no values, a deleted connection cannot recover, the fill example narrows to the managed auth state before reading field names, and the TOTP step notes sites that auto-submit the code. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

cursor

Risk assessment: Very Low

I reviewed the diff (9 files, +308/−2). Every change is documentation for the Mintlify site:

New how-to page auth/fill-from-managed-auth.mdx and snippet files with TypeScript, Python, cURL, and an example JSON response.
One cross-link sentence in auth/fill-from-vault.mdx.
A sidebar entry for the new page in docs.json.

No application code, infrastructure, CI, authentication implementation, or agent-instruction files are modified. docs.json only adds the new page to navigation. Code owner review is not required on main.

Approving.

_{Sent by Cursor Automation: Assign PR reviewers}

cursor

Risk assessment: Very Low

Re-checked the current head (d200cc1). The diff is still documentation for the Mintlify site only: a new how-to (auth/fill-from-managed-auth.mdx), six example snippets, one cross-link in auth/fill-from-vault.mdx, and a sidebar entry in docs.json (9 files, +308/−2).

No application code, infrastructure, CI, authentication implementation, or agent-instruction files changed. require_code_owner_review is off on main, and there is no CODEOWNERS file.

This automation already approved this same commit. Risk has not increased, so that approval stands and I am not approving again.

_{Sent by Cursor Automation: Assign PR reviewers}

cursor

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit d200cc1. Configure here.}

- Set timeout_ms to its 30-second maximum in the fill example; the default 10 seconds can be too short for several fields. - Break the submit step's follow-ups into a list (Bugbot). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

cursor

Risk assessment: Very Low

Re-checked head d261821 against the previously approved commit d200cc1. The new commit only edits docs:

Example snippets set timeout_ms to 30000 on the fill call.
The submit step in auth/fill-from-managed-auth.mdx is split into a list, plus one sentence explaining that timeout.

The full diff is still Mintlify documentation: a how-to page, example snippets, one cross-link in auth/fill-from-vault.mdx, and a sidebar entry in docs.json (9 files, +314/−2). No application code, infrastructure, CI, authentication implementation, or agent-instruction files changed. There is no CODEOWNERS file.

Risk has not increased. This automation already approved the PR, so that approval stands and I am not approving again.

_{Sent by Cursor Automation: Assign PR reviewers}

AnnaXWang · 2026-09-25T16:10:40Z

+
+Managed Auth saves the durable fields a user enters during login, such as an email and password, so it can attempt eligible reauthentication later. A credential item backed by a Managed Auth connection lets your application reuse that saved credential with [`fill`](/vaults/fill): your application or agent drives the login form in its own browser session, and Kernel writes the values, without collecting the credential a second time or returning it to your application.
+
+The item stores no values of its own. It reads the connection's saved credential each time you read the item or invoke `fill`, so a password updated through Managed Auth is used immediately.


so a password updated through Managed Auth is used immediately. is confusing! @bmsaadat does this mean "using fill for a password updated through Managed Auth will automatically use the updated value"?

Yes your interpretation is correct! Great catch, will update it to reflect your wording better

Updated in a0950af

AnnaXWang · 2026-09-25T16:13:10Z

+import NavigateGitHubLogin from "/snippets/navigate-github-login.mdx";
+import FillManagedAuthCredential from "/snippets/fill-managed-auth-credential.mdx";
+
+Managed Auth saves the durable fields a user enters during login, such as an email and password, so it can attempt eligible reauthentication later. A credential item backed by a Managed Auth connection lets your application reuse that saved credential with [`fill`](/vaults/fill): your application or agent drives the login form in its own browser session, and Kernel writes the values, without collecting the credential a second time or returning it to your application.


Suggested change

Managed Auth saves the durable fields a user enters during login, such as an email and password, so it can attempt eligible reauthentication later. A credential item backed by a Managed Auth connection lets your application reuse that saved credential with [`fill`](/vaults/fill): your application or agent drives the login form in its own browser session, and Kernel writes the values, without collecting the credential a second time or returning it to your application.

Managed Auth saves the durable fields a user enters during login, such as an email and password, as a credential item. [`fill`](/vaults/fill) allows your application to reuse credentials backed by a Managed Auth connection, even outside of a Managed Auth workflow. With `fill`, your application or agent drives the login form in its own browser session, and Kernel writes the values, without collecting the credential a second time or returning it to your application.

Thanks, this reads a lot better! I took it nearly as-is with one small tweak: the rest of the page uses "credential item" for the vault item you create from the connection, so I said Managed Auth saves the fields "as a credential" to keep the two from blurring together. Your "even outside of a Managed Auth workflow" line is in word for word. Updated in a0950af, happy to adjust if you'd phrase it differently!

AnnaXWang

2 suggestions, otherwise lgtm

- Lead with reusing the credential even outside a Managed Auth workflow, and keep "credential" (what Managed Auth saves) apart from the vault credential item created from the connection. - Say plainly that the next fill uses an updated password automatically. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

cursor

Risk assessment: Very Low

Re-checked head a0950af against the previously reviewed commit d261821. The new commit only rewrites two paragraphs in auth/fill-from-managed-auth.mdx: it clarifies that fill can reuse a Managed Auth credential outside a Managed Auth workflow, and that a later fill picks up a password change automatically.

The full diff is still Mintlify documentation: a how-to page, example snippets, one cross-link in auth/fill-from-vault.mdx, and a sidebar entry in docs.json (9 files, +314/−2). No application code, infrastructure, CI, authentication implementation, or agent-instruction files changed. The main ruleset has require_code_owner_review off, and there is no CODEOWNERS file.

Risk has not increased. This automation already approved the PR, so that approval stands and I am not approving again.

_{Sent by Cursor Automation: Assign PR reviewers}

mintlify Bot deployed to staging September 22, 2026 21:51 View deployment

mintlify Bot deployed to staging September 22, 2026 21:59 View deployment

cursor Bot approved these changes Sep 22, 2026

View reviewed changes

bmsaadat marked this pull request as ready for review September 23, 2026 19:19

bmsaadat requested a review from AnnaXWang September 23, 2026 19:19

cursor Bot reviewed Sep 23, 2026

View reviewed changes

Comment thread auth/fill-from-managed-auth.mdx Outdated

mintlify Bot deployed to staging September 25, 2026 15:14 View deployment

cursor Bot reviewed Sep 25, 2026

View reviewed changes

AnnaXWang reviewed Sep 25, 2026

View reviewed changes

AnnaXWang approved these changes Sep 25, 2026

View reviewed changes

mintlify Bot deployed to staging September 25, 2026 16:58 View deployment

cursor Bot reviewed Sep 25, 2026

View reviewed changes


		Managed Auth saves the durable fields a user enters during login, such as an email and password, so it can attempt eligible reauthentication later. A credential item backed by a Managed Auth connection lets your application reuse that saved credential with [`fill`](/vaults/fill): your application or agent drives the login form in its own browser session, and Kernel writes the values, without collecting the credential a second time or returning it to your application.

		The item stores no values of its own. It reads the connection's saved credential each time you read the item or invoke `fill`, so a password updated through Managed Auth is used immediately.

Conversation

bmsaadat commented Sep 22, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mintlify Bot commented Sep 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Risk assessment: Very Low

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Risk assessment: Very Low

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Risk assessment: Very Low

Uh oh!

AnnaXWang Sep 25, 2026

Choose a reason for hiding this comment

Uh oh!

bmsaadat Sep 25, 2026

Choose a reason for hiding this comment

Uh oh!

bmsaadat Sep 25, 2026

Choose a reason for hiding this comment

Uh oh!

AnnaXWang Sep 25, 2026

Choose a reason for hiding this comment

Uh oh!

bmsaadat Sep 25, 2026

Choose a reason for hiding this comment

Uh oh!

AnnaXWang Sep 25, 2026

Choose a reason for hiding this comment

Uh oh!

AnnaXWang left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Risk assessment: Very Low

Uh oh!

This branch was successfully deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

bmsaadat commented Sep 22, 2026 •

edited by cursor Bot

Loading

mintlify Bot commented Sep 22, 2026 •

edited

Loading