From 2dc8156ef7ac2cf62ef8a853eb32a856e787ed8a Mon Sep 17 00:00:00 2001
From: masnwilliams <43387599+masnwilliams@users.noreply.github.com>
Date: Tue, 4 Aug 2026 15:23:58 +0000
Subject: [PATCH 1/3] Document sensitive identity provider safety
---
auth/connection-lifecycle.mdx | 2 +-
auth/faq.mdx | 6 +++++-
2 files changed, 6 insertions(+), 2 deletions(-)
diff --git a/auth/connection-lifecycle.mdx b/auth/connection-lifecycle.mdx
index 535002ea..b2a874e9 100644
--- a/auth/connection-lifecycle.mdx
+++ b/auth/connection-lifecycle.mdx
@@ -18,7 +18,7 @@ After the initial login, every connection moves through this loop:
If the check finds the session expired and the connection's `can_reauth` is `true`, Kernel runs the saved login flow with the stored credentials in the background. A successful login resets the loop.
- If auto-reauth isn't possible — credentials aren't linked, the saved flow requires human input, or the login keeps failing — the connection's `status` flips to `NEEDS_AUTH` and a new login session is required.
+ If auto-reauth isn't possible — credentials aren't linked, the saved flow requires human input, or the login keeps failing — the connection's `status` flips to `NEEDS_AUTH`. Scheduled health checks pause until a new login succeeds.
diff --git a/auth/faq.mdx b/auth/faq.mdx
index cb0c9126..e58f4911 100644
--- a/auth/faq.mdx
+++ b/auth/faq.mdx
@@ -4,7 +4,7 @@ title: FAQ
## How does automatic re-authentication work?
-When you link credentials to a connection, Kernel runs periodic health checks, detects logged-out sessions, and re-authenticates in the background so the profile stays logged in. See [Connection Lifecycle](/auth/connection-lifecycle) for the full lifecycle, cadence options, and `can_reauth` rules.
+When you link credentials to a connection, Kernel runs periodic health checks, detects logged-out sessions, and re-authenticates in the background so the profile stays logged in. Scheduled checks pause when the connection enters `NEEDS_AUTH` and resume after a successful login. See [Connection Lifecycle](/auth/connection-lifecycle) for the full lifecycle, cadence options, and `can_reauth` rules.
## What are sign-in options?
@@ -18,6 +18,10 @@ Managed Auth supports username/password authentication and most SSO providers.
Passkey-based authentication (e.g., Google accounts with passkeys enabled) is not currently supported. If a user's SSO provider requires a passkey, the login will fail with the `unsupported_auth_method` error code.
+
+For Google and other sensitive identity providers, use an established account and attach a stable ISP or custom proxy before login. Keep the default 1-hour health-check interval unless you need faster detection; repeated checks from a new account or changing IP addresses can trigger the provider's security controls. Google connections require stable egress when using 5-minute checks.
+
+
## What happens if login fails?
Kernel retries with exponential backoff, then surfaces an error code (`credentials_invalid`, `bot_detected`, `captcha_blocked`, etc.). See [Connection Lifecycle](/auth/connection-lifecycle#when-a-login-fails) for the full list and recovery steps.
From be52786ecb0dc3590c090bf49e55e114e001a3e1 Mon Sep 17 00:00:00 2001
From: masnwilliams <43387599+masnwilliams@users.noreply.github.com>
Date: Tue, 4 Aug 2026 15:28:55 +0000
Subject: [PATCH 2/3] Keep managed auth recovery checks documented
---
auth/connection-lifecycle.mdx | 2 +-
auth/faq.mdx | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/auth/connection-lifecycle.mdx b/auth/connection-lifecycle.mdx
index b2a874e9..535002ea 100644
--- a/auth/connection-lifecycle.mdx
+++ b/auth/connection-lifecycle.mdx
@@ -18,7 +18,7 @@ After the initial login, every connection moves through this loop:
If the check finds the session expired and the connection's `can_reauth` is `true`, Kernel runs the saved login flow with the stored credentials in the background. A successful login resets the loop.
- If auto-reauth isn't possible — credentials aren't linked, the saved flow requires human input, or the login keeps failing — the connection's `status` flips to `NEEDS_AUTH`. Scheduled health checks pause until a new login succeeds.
+ If auto-reauth isn't possible — credentials aren't linked, the saved flow requires human input, or the login keeps failing — the connection's `status` flips to `NEEDS_AUTH` and a new login session is required.
diff --git a/auth/faq.mdx b/auth/faq.mdx
index e58f4911..622fe431 100644
--- a/auth/faq.mdx
+++ b/auth/faq.mdx
@@ -4,7 +4,7 @@ title: FAQ
## How does automatic re-authentication work?
-When you link credentials to a connection, Kernel runs periodic health checks, detects logged-out sessions, and re-authenticates in the background so the profile stays logged in. Scheduled checks pause when the connection enters `NEEDS_AUTH` and resume after a successful login. See [Connection Lifecycle](/auth/connection-lifecycle) for the full lifecycle, cadence options, and `can_reauth` rules.
+When you link credentials to a connection, Kernel runs periodic health checks, detects logged-out sessions, and re-authenticates in the background so the profile stays logged in. See [Connection Lifecycle](/auth/connection-lifecycle) for the full lifecycle, cadence options, and `can_reauth` rules.
## What are sign-in options?
From d6b3a4e977212fabc5af0089e25de184cd604777 Mon Sep 17 00:00:00 2001
From: masnwilliams <43387599+masnwilliams@users.noreply.github.com>
Date: Tue, 4 Aug 2026 15:30:40 +0000
Subject: [PATCH 3/3] Keep identity provider guidance generic
---
auth/faq.mdx | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/auth/faq.mdx b/auth/faq.mdx
index 622fe431..be865a0f 100644
--- a/auth/faq.mdx
+++ b/auth/faq.mdx
@@ -19,7 +19,7 @@ Passkey-based authentication (e.g., Google accounts with passkeys enabled) is no
-For Google and other sensitive identity providers, use an established account and attach a stable ISP or custom proxy before login. Keep the default 1-hour health-check interval unless you need faster detection; repeated checks from a new account or changing IP addresses can trigger the provider's security controls. Google connections require stable egress when using 5-minute checks.
+For sensitive identity providers, use an established account and attach a stable ISP or custom proxy before login. Keep the default 1-hour health-check interval unless you need faster detection; repeated checks from a new account or changing IP addresses can trigger the provider's security controls.
## What happens if login fails?