November 4, 2026 · 4 min read
Testing apps behind a sign-in: CAPTCHA, 2FA and saved sessions
Automated tests can't (and shouldn't) solve CAPTCHAs or read your 2FA codes. Qavtrix lets you sign in once yourself and starts every run signed in.
Most of the value in a product sits behind its sign-in page, and so do most of its testing problems. Test accounts get rate-limited, CAPTCHAs block automated browsers on purpose, and 2FA codes go to a phone that the test runner doesn't have.
Trying to automate around these protections is fragile at best. They exist to stop bots, and a test runner is a bot.
Spotting a sign-in wall
When a Qavtrix run fails, it looks at the page where the test stopped. A password field, a failing sign-in step or a login URL in the error means the test hit a sign-in wall, so the run asks you to sign in instead of reporting a broken test.
Sign in once, by hand
Run the one-line command from the run page and Playwright's Chrome opens at your app. Sign in as your test user, including CAPTCHA, 2FA or SSO, and close the window. The browser saves your session (cookies and local storage) to a file that you upload to the project.
From then on every run of that project starts already signed in. The session is stored encrypted, is never shown again, and you can replace or remove it at any time. When it expires, the next run that hits the sign-in page asks again.