A Bot that keeps landing on a login screen is usually not broken. It is doing exactly what it should: refusing to handle your credentials, and waiting for you.
The sequence that works
- Open the computer and take control. Signing in happens on the machine, by you, not through the conversation.
- Complete the whole thing: password, two-factor code, CAPTCHA, whatever the site demands.
- Confirm the signed-in page has actually loaded before you hand control back. This is the step people skip, and it is the one that makes the difference: returning control on a half-finished login leaves the Bot exactly where it started.
- Hand control back and tell the Bot to continue from the current page.
Never paste the credential into chat
Not the password, not the one-time code. The documentation says so repeatedly, and the reason is the transcript: a chat message is a record, and a code pasted into it is a credential in a log.
Where a connection supports a secure secret request, the value is masked, kept out of the transcript and not shown to the model. That is the supported path for a credential, and it is a narrow feature, not a password manager.
Some sites will keep asking
Worth accepting rather than fighting: some services expire sessions aggressively, and some demand verification for every sensitive action. The documentation is explicit that this cannot always be avoided. If a site re-authenticates on every transfer, no amount of setup will make that go away.
For those, the realistic pattern is to be present: schedule the work for a time you are around, rather than overnight.
When it happens to every site: repeatedly
That is a different problem, and usually structural:
- The machine was recreated or its address changed, and sessions inside it dropped with it. Common after a recovery or reset.
- The service is blocking datacenter addresses. Bots reach the internet from static egress addresses; some services flag those.
Both have organisation-level remedies rather than personal ones: allowlisting the egress ranges, storing passkeys in the computer's password manager, or the beta setting that routes the computer's traffic through your own machine. If you are not the administrator, this is the point to ask one.
A note on what you are signing in to
Every Bot on your account shares that browser and those sessions. Signing in on the shared computer grants access to your whole roster, not to the Bot that asked; see Connecting Bots to your tools safely. Sign in with the account you would be comfortable giving all of them.
What changes
Session handling and the network-routing options are actively developing. Confirm current behaviour in the troubleshooting documentation.