Login methods

Use these recipes to sign in during a test. Choose the method your app uses.

Log in with email OTP codes

Your app emails a one-time passcode to the provisioned inbox, and a JavaScript step in the test fetches the latest message and pulls the code out. Use this recipe when login arrives as a code instead of a link.

Prerequisite: A Momentic-provisioned inbox (@usemomentic.com or @gomomentic.com). Request one.

Fetch the code

Add a JavaScript step that reads the latest email, parses the code, and saves it to the environment. Set inbox to your provisioned inbox.

const msg = await email.fetchLatest({
  inbox: "otp+test",
  afterDate: new Date(Date.now() - 60_000),
  timeout: 30_000,
});

const [code] = msg.text.match(/\b\d{6}\b/) ?? [];
if (!code) throw new Error("No OTP code found in email");
setVariable("OTP_CODE", code);

Then add a Type step with value {{ env.OTP_CODE }} targeting the OTP input.

Pass afterDate to exclude messages older than the specified time.

This script polls for up to 30 seconds. The JavaScript step defaults to 90 seconds. On the CLI, raise the step’s Timeout field up to 600 seconds for longer scripts.

SMS OTP
Email verification links
Email integration

Log in with SMS OTP codes

Your app texts a one-time passcode to the provisioned number, and a JavaScript step in the test fetches the latest message and pulls the code out. Use a single number for serial runs; lease numbers from a pool when tests run in parallel through the CLI.

Prerequisite: A Momentic-provisioned phone number. Request one.

Single-number setup

If you only need OTP login from one fixed number (or your tests don’t run in parallel), fetch the latest message and pull the code out:

const msg = await sms.fetchLatest({
  to: "+18888888888",
  afterDate: new Date(Date.now() - 60_000),
  timeout: 30_000,
});

const [code] = msg.body.match(/\b\d{6}\b/) ?? [];
if (!code) throw new Error("No OTP code found in SMS");
setVariable("OTP_CODE", code);

Then add a Type step with value {{ env.OTP_CODE }}.

Parallel CLI runs against the same OTP flow

If you run the same OTP login test in parallel (e.g. multiple shards in CI), two tests can race on the same inbound code. Lease a number from your pool so each shard gets its own. Momentic releases it back to the pool when the test finishes. Lease the number, have your app send the code to it, then fetch the code:

const { phoneNumber } = await sms.lease();

const msg = await sms.fetchLatest({
  to: phoneNumber,
  afterDate: new Date(Date.now() - 60_000),
  timeout: 30_000,
});

const [code] = msg.body.match(/\b\d{6}\b/) ?? [];
if (!code) throw new Error("No OTP code found in SMS");
setVariable("OTP_CODE", code);

See sms.lease() for full options (TTL, fail-fast, optional manual release).

Both examples poll for up to 30 seconds. The JavaScript step defaults to 90 seconds. On the CLI, raise the step’s Timeout field up to 600 seconds for longer scripts.

Email OTP
OTPAuth (TOTP)
SMS integration

Log in with email verification links

Your app emails a magic login link to the provisioned inbox, and a JavaScript step in the test fetches the latest message and pulls the link out. Use this recipe when login arrives as a URL instead of a code.

Prerequisite: A Momentic-provisioned inbox. Request one.

Fetch and navigate

Add a JavaScript step that fetches the latest email, extracts the verification link, and saves it to the environment. Set inbox to your provisioned inbox.

const msg = await email.fetchLatest({
  inbox: "link+test",
  afterDate: new Date(Date.now() - 60_000),
  timeout: 30_000,
});

const [link] = msg.text.match(/https?:\/\/[^\s]+/) ?? [];
if (!link) throw new Error("No verification link found in email");
setVariable("VERIFICATION_LINK", link);

Then add a Navigate step with URL {{ env.VERIFICATION_LINK }}.

This script polls for up to 30 seconds. For longer polls, raise email.fetchLatest’s timeout in milliseconds, up to 105,000. Set the JavaScript step’s Timeout high enough to cover the whole script. The step defaults to 90 seconds. On the CLI, the step’s Timeout can be raised to 600 seconds.

Log in with OTPAuth (TOTP)

Prerequisite: A Base32 TOTP secret (shown during 2FA enrollment) or an otpauth:// URI (often embedded in a QR code).

Generate a time-based 2FA code inside a JavaScript step with the otpauth library, which Momentic preloads in the step sandbox. Reach for this when a login flow asks for an authenticator-app code.

From a Base32 secret

const totp = new OTPAuth.TOTP({
  issuer: "MyApp",
  label: "alice@example.com",
  algorithm: "SHA1",
  digits: 6,
  period: 30,
  secret: env.TOTP_SECRET, // Base32-encoded
});

setVariable("TOTP_CODE", totp.generate());

From an `otpauth://` URI

const totp = OTPAuth.URI.parse(env.TOTP_URI);
setVariable("TOTP_CODE", totp.generate());

Then add a Type step with value {{ env.TOTP_CODE }}.

Store the secret as an environment variable rather than hardcoding it.

Cache authenticated sessions

In web tests, cache the login module to reuse saved browser state across runs. This reduces repeated sign-ins and requests to your auth provider.

If you’re new to auth in Momentic, start with Authentication strategies for the full set of options and trade-offs.

Setup

Extract your login steps into a Module. The last step should verify the authenticated state (e.g. an Element check for the dashboard heading).
In the module config, turn on Enable caching globally (defaultCacheAllInvocations) and Treat as auth module (autoAuth).
Set a Default cache key (defaultCacheKey, e.g. admin-user). Parallel tests sharing the key reuse the same cached session.
Set Default expiry seconds (stored as defaultCacheTtl in milliseconds) shorter than your session lifetime.
Remove any Save auth state / Load auth state (authSave / authLoad) steps. A cached auth module saves and restores the state automatically; see Save and restore a state file.

The module’s stored config looks like this:

log-in.module.yaml

fileType: momentic/module/v2
id: log-in
name: Log in
autoAuth: true # Treat as auth module
defaultCacheAllInvocations: true # Caching globally
defaultCacheKey: admin-user # Default cache key
defaultCacheTtl: 3600000 # Default expiry (1 hour, in ms)
steps:
  - type:
      text: "{{ env.USERNAME }}"
      into: Email input
  - type:
      text: "{{ env.PASSWORD }}"
      into: Password input
  - click: Log in
  - checkElementVisible: the Dashboard heading

Invoke it from each test’s before section:

checkout.test.yaml

before:
  - module: ../modules/log-in.module.yaml

Use different cache keys for different user roles (e.g. admin, member) so state doesn’t carry over between them.

What gets cached

Momentic captures cookies, localStorage, and IndexedDB when the module finishes. On subsequent runs within the expiry window, it restores that state and skips the module’s steps.

Test Vercel protected preview environments

Prerequisite: A Vercel protection bypass secret.

In web tests, send the bypass secret in headers or query parameters. If CORS blocks the headers, use query parameters instead.

Option A: headers

In the test’s Network options, add:

Header	Value
`x-vercel-protection-bypass`	`<your-secret>`
`x-vercel-set-bypass-cookie`	`true`

These headers are sent with every request in the session, including third-party script requests. If you see CORS errors, use query parameters instead.

Option B: query parameters

Override the base URL in the test’s General options:

https://your-preview.vercel.app?x-vercel-protection-bypass=<secret>&x-vercel-set-bypass-cookie=true

Vercel sets the bypass as a cookie for the rest of the session, so subsequent requests don’t need the query string.

Vercel docs: Protection bypass automation

Get started

Mo

Regression tests

App setup

Write tests

Run tests

Maintain tests

Integrations

Workspace

Migrate and upgrade

Log in with email OTP codes

Fetch the code

Log in with SMS OTP codes

Single-number setup

Parallel CLI runs against the same OTP flow

Log in with email verification links

Fetch and navigate

Log in with OTPAuth (TOTP)

From a Base32 secret

From an `otpauth://` URI

Cache authenticated sessions

Setup

What gets cached

Test Vercel protected preview environments

Option A: headers

Option B: query parameters

Log in with email OTP codes

Fetch the code

Related

Log in with SMS OTP codes

Single-number setup

Parallel CLI runs against the same OTP flow

Related

Log in with email verification links

Fetch and navigate

Related

Log in with OTPAuth (TOTP)

From a Base32 secret

From an otpauth:// URI

Related

Cache authenticated sessions

Setup

What gets cached

Related

Test Vercel protected preview environments

Option A: headers

Option B: query parameters

Related

From an `otpauth://` URI