login-2fa-flow

Get an automated login past its 2FA challenge without burning attempts or locking the account. Fixes the specific failures that make this flaky: doing the challenge at all when a saved session would have worked, generating a code seconds before it expires, resubmitting a rejected code, retrying into a lockout, and grinding against a push or WebAuthn prompt that no script can satisfy.

Authorisation first

Automate 2FA only for accounts the user owns or is authorised to automate. If the request involves someone else's personal credentials, stop and ask whether this is a sanctioned service or shared account. The legitimate answer is almost always a dedicated automation account, delegated access, or the person running it themselves.

When NOT to use