Authentication overview

Authentication overview

StatePort separates the portable reproduction from the local capability used to satisfy authentication.

State Card / Capture Session / State Capsule
+ optional non-secret Auth Persona requirement
+ local protected Auth Binding or browser session
= authenticated reproduction on this device

• An Auth Persona is a non-secret logical identity, such as Manager · QA.
• An Auth Binding is approved machine-local credential/session material used only to satisfy that Persona for a supported project, environment, origin, and storage policy.

Raw Auth Binding values stay outside ordinary State Cards, Capture Sessions, State Capsules, revisions, run evidence, ordinary share bundles, normal renderer state, machine-readable CLI/MCP responses, logs, crash evidence, and analytics.

A Development Profile login is not a portable Auth Binding. Development Profile state remains machine-local browser convenience and is never transferred by an ordinary State Card share.

Capture and authentication

Sign in normally while preparing the state in the managed Capture browser. If the captured actions show a sign-in attempt and the exact approved application-origin session changes, Review shows bounded cookie/storage descriptors and offers Save this sign-in as a Persona. A new anonymous session during ordinary browsing is not enough. The choice remains selected by default for a detected sign-in, can be deselected, and saves the protected local Binding together with the State Card. Create a separate local-app Persona through Capture and Review for that exact app; the current Desktop has no Persona Manager in Settings. See Personas and bindings for the available path.

If the Capture environment is Other, Review still offers the detected sign-in. Choose Sign-in environment before saving the Persona, or deselect the Persona option to save only the State Card. The Card’s source label stays unchanged. An approved staging sign-in remains scoped to that exact application; StatePort does not treat every remote application as production.

In managed Capture, material present before recording is not proposed merely because the browser is already signed in. Chrome Capture has a separate explicit Review choice, Keep current browser sign-in on this device, for selected existing cookies and sign-in storage. This permits reuse only for the exact original application and does not transfer sign-in into a different local app. Raw values never enter renderer state or the ordinary Card.

If a sign-in action was recorded without a Persona proposal, Review explains whether session material was unchanged or changed state was not recognized as reusable authentication. You can still save the State Card without a Persona. Detection includes cookies available at the origin root and Capture starting URL, using the same scope before and after sign-in. Cookies scoped only to other paths are not detected.

Authentication may come from the StatePort-owned Development Profile or from an approved local Auth Persona/Binding where the workflow supports it. The saved State Card carries only safe requirements/status needed to explain what must be available on the machine that reproduces it.

Protected values captured during a workflow

Protected form values are a separate concept from Auth Personas and Auth Bindings.

Desktop manual Capture keeps supported sensitive candidates encrypted on this device for Review by default. You can choose Skip sensitive values during Capture instead. If it finds a supported candidate, Review requires a keep-or-discard decision before saving. Ordinary State Cards never contain the raw values. When you keep a protected candidate:

• the value is stored through the OS-protected machine-local boundary;
• it remains available only on that device;
• using it requires explicit authorization for each reproduction run;
• Card-only sharing omits the value; the recipient may need manual input or separately accepted protected replay material.

If the creator confirms Discard, StatePort removes the protected local value, derives a sanitized saved Session, and leaves a manual Journey barrier for that step. The ordinary credential-free State Card can then be shared when no other blocker remains.

When a supported sensitive input was discarded or its protected value is unavailable on this device, Journey pauses before the input step. Enter the missing value directly in the managed browser, then choose Resume. The remaining recorded actions continue automatically. This does not save the new value into the State Card or grant access to protected storage. Other unsupported interactions can still make a Journey unavailable.

Open final state can also pause for a retained password whose protected value is missing or was not allowed for this run. StatePort shows the managed page at that input step. Enter the password there, then choose Resume saved state. The restoration cover returns while the remaining actions run. A discarded step uses Replay journey instead because its automatic final-state plan is no longer available.

These independent protected values are not a portable Auth Persona. When a Card instead declares a portable non-secret authentication requirement, the sender may separately offer one cohesive Protected Persona. It is never included by default and never becomes ordinary State Card data.

Clean Session

Clean Session starts from a fresh isolated browser context and restores only the approved State Card state plus local authentication material that the current machine is allowed to use.

If the required local authentication is missing, expired, rejected, policy-denied, or scoped to the wrong origin/environment, StatePort fails closed and asks for the appropriate local recovery rather than reusing hidden Development Profile state.

Captured source and authentication

Original environment uses an isolated Clean Session. A Card with eligible retained page material serves that material locally; an anonymous-public page that passed the offline proof does not contact production during that replay. Any required Private replay data must be available and explicitly accepted when received from another developer.

A Chrome Capture Card does not archive application code. Original environment loads current application code and permitted public assets from its exact source origin, then replays captured API data. Compatible legacy Cards may also load the current source shell. These paths require the source site to be reachable and do not promise zero-egress reproduction. Unmatched API requests remain blocked. Local app uses its own authorized sign-in; source sign-in is not remapped to it.

Ordinary sharing

An ordinary encrypted State Card share sends the portable reproduction, not the sender’s machine-local login capability.

It excludes:

• retained protected local values;
• raw cookies and bearer/access/refresh tokens;
• Authorization headers;
• browser-profile contents;
• local Auth Binding values;
• local sign-in state.

The recipient imports the State Card locally and establishes their own compatible authentication when the reproduction requires it.

When a Card has one unambiguous validated authenticated session, Share visibly selects its separately encrypted Protected Persona and already-approved scope; the sender may choose Card-only instead or review the exact permissions before creating the protected link. Multiple unbound Persona choices are never guessed. The recipient first sees a safe descriptor—Persona label/classification, material kinds/counts, exact allowed origins and lifecycle—and chooses Import Card only, Accept Persona, or Decline. Accepting creates a new recipient-local Persona/Binding; it does not copy the sender’s local identity. Expired, revoked-before-import, corrupt or incompatible Persona material fails closed while Card-only import remains. Revoking the link cannot remove a Persona the recipient already imported.

An optional Protected Sensitive Attachment is separate from ordinary sharing. When a protected Capture candidate is available, a creator explicitly selects it for one encrypted share; the recipient can import the Card only, accept the attachment into protected local storage, or decline it. Production, customer and payment contexts show an elevated warning and must never be included implicitly.

If the same Card has already been imported, the recipient can keep it and import the newly selected protected values as a separate local Card, or explicitly choose Replace existing State Card before accepting those values. Replacement keeps the existing Card until the new import succeeds. It gives the replacement a new local identity and import time, so earlier verification results are not silently treated as results for the new Card. Import Card only keeps the existing Card and does not install protected values.

Transferring by file

Export State Card supports the same protected values and Persona selection as Share. Import State Card shows the same review and acceptance choices as opening a link. Nothing protected is accepted automatically.

Anyone with the exported file can access the selected included data. Keep and send it accordingly; the file is not password-protected and cannot be revoked after delivery. Accepted values are stored in the recipient’s protected local storage with the existing scope, expiry and run-confirmation rules.