Sign your bot in with your Chrome cookies

What this does for you

You are already signed in to many sites in Google Chrome on your own computer. When your bot needs one of those sites in its computer browser, it can ask to use your Chrome cookies for that one site. You say yes or no on a card. If you say yes, the Botseon desktop app copies that site's cookies from your Chrome into the bot's computer browser, and the bot is signed in there as you are, without typing your password.

• One site at a time. The bot names the site, and only that site's cookies are copied: the site itself and its own subdomains. Cookies of every other site stay on your computer.
• Only cookies, never passwords. Chrome keeps saved passwords in a separate file. The desktop app never opens it.
• Every time. The card is shown every time a bot asks, and no rule can answer it for you. One yes copies the cookies once.

Before you start

• The Botseon desktop app is installed on the computer where you use Chrome, and you are signed in to it.
• That computer's Execution on this device setting is not Never allow, and your organisation's Execution on local computer setting is not Never allow. Cookies are read through the same channel as other work on your computer.
• You are signed in to the site in Google Chrome on that computer.
• The bot has a computer, and its browser is open. If it is not, the bot opens a page first.

Steps

1. The bot asks. A card appears in the conversation with the tool request_cookie_origin_approval and the site the bot wants, for example mail.example.com. It has two buttons: Allow once and Deny. There is no Always allow.
2. Choose Allow once to copy that site's cookies, or Deny to copy nothing.
3. Your computer may ask for permission. On a Mac, macOS asks for your login keychain password the first time, so Chrome's saved cookies can be read. Nothing is copied if you cancel that prompt. See If it does not work.
4. Read the result. A second card, Cookies for the site, shows where the import ended: Requested → Allowed → Imported with how many cookies were copied, or Requested → Allowed → Failed with the reason. Every card says: Only cookies are copied, never passwords.
5. The bot carries on. When the import worked, the bot loads the site again in its computer browser and is signed in.

What happens to the cookies on the way

The desktop app locks the cookies with a key that only the bot's current task holds, before they leave your computer. Botseon stores only the locked copy while the task waits, and the key is gone when the task ends, so nobody can open that copy afterwards — not Botseon staff and not a later task. The cookies are never written to a log.

On the bot's computer, the cookies go into its browser, and they stay there like any other sign-in the bot makes. They are shared by every screen of that computer. To sign the bot out, sign out of the site in the bot's computer browser, or choose Cookie approvals… in the desktop app's menu and Revoke the site.

If it does not work

The Cookies for card names the reason. What each one means:

Limits

• Chrome only. Other browsers' cookies are not read.
• Only the default Chrome profile is read.
• Some sites also keep you signed in with data that is not a cookie. For those, sign in to the site in the bot's computer browser once.