# How to test authenticated browser flows

Separate identity-provider behavior from the app flows that require login. Validate the precise login setup before relying on automated browser tests.

## Why it is hard

- Provider redirects can cross origins.
- MFA and email challenges need their own test setup.
- An authenticated session can outlive the state a test expects.

## Plan the test around an observable outcome

1. Use dedicated test identities and a supported test environment.
2. Test provider-specific behavior with the provider’s test tooling.
3. Define a repeatable browser login path for application tests.
4. Verify the post-login account state and permissions separately.

## Where Zerocheck fits

1. Configure per-environment login steps and named credential references.
2. Validate that the hosted browser can reach the required app environment.
3. Use the local CLI for localhost or private-network apps.
4. Evaluate external-provider redirects before adopting; do not assume arbitrary OAuth, SSO or MFA coverage.

## Be precise about “authenticated testing”

A test can sign in through configured browser steps and then exercise the app. That is different from verifying every identity-provider integration, second factor or recovery flow. Define which part is in scope and which fixtures make it repeatable.

## Credentials and local runs

Reference credentials by name and configure their values where the browser runs. Local execution still needs a Zerocheck token, uses the AI service and uploads results. Configured secrets are redacted, but you should use test accounts and avoid sensitive customer data.

## Pitfalls

- Do not bypass production authentication controls for a casual test.
- Do not paste secrets into test descriptions or YAML.
- Do not assume one login flow covers all identity-provider behavior.

## Frequently asked questions

### Does Zerocheck support any OAuth or SSO provider automatically?

No. External redirects and provider-specific challenges require evaluation. Email and SMS steps are unsupported.

### Does the Zerocheck service itself offer SSO?

No. The current offering uses provisioned instance access, without SSO or role-based permissions.

Related: [Email Flow Testing Boundaries](https://tryzerocheck.com/use-cases/email-flow-testing/)

---
Canonical: https://tryzerocheck.com/guides/test-oauth-sso/
Updated: 2026-09-14