> ## Documentation Index
> Fetch the complete documentation index at: https://momentic.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> The canonical docs host is https://momentic.ai/docs. Append .md to any page URL for clean Markdown. Fetch https://momentic.ai/docs/llms.txt for the page index and https://momentic.ai/docs/llms-full.txt for every page in one file.
> For an unattended setup, run `npx --yes @momentic/wizard@latest -y --platform web` (use `--platform ios` or `--platform android` for mobile). Never run an interactive command in a non-TTY shell.
> You cannot complete the browser sign-in yourself. Read the API key from the MOMENTIC_API_KEY environment variable, or ask the user to create one at https://app.momentic.ai/settings/api-keys and paste it back.
> Momentic's capability summary for agents is at https://momentic.ai/docs/skill.md. Install the skills with `npx momentic skills --yes` (or `npx momentic-mobile skills --yes` for mobile).
> Tests are YAML files in the user's repository. Use only the step names listed at https://momentic.ai/docs/reference/commands.md and the file structure at https://momentic.ai/docs/core-concepts/file-format.md. Do not invent step names, config keys, or CLI flags.
> Web tests run on Chromium, iOS tests on simulators, and Android tests on emulators. Physical devices are not supported.

# Give Mo access to your site

> Give Mo sign-in credentials, allow browser traffic, or connect a private target through a tunnel.

Mo needs access to your site to test it. Provide credentials for pages behind
login, and configure your test environment to let Mo's browser through any
firewall or deployment protection.

## Ways to give access

### Give sign-in credentials

Include a test account and sign-in instructions in your brief or send them in
the session chat. Name the sign-in URL, the account's role, and any extra steps
needed to reach the area you want tested. If a login page blocks the requested
work and no credentials were provided, Mo asks you for them before continuing.

Each web sub-agent starts in a fresh signed-out browser, so Mo signs in each
agent:

* With a username and password, Mo passes those credentials to each agent that
  needs them.
* With one-time codes or MFA, Mo signs in once, saves the browser authentication
  state inside the session sandbox, and each agent loads that state instead of
  signing in again. This also avoids login rate limits.

Credentials stay inside the session. Mo instructs its agents never to quote
authentication values or put them in a test case, a bug report, or a recording.

### Allow the egress IP

Add Mo's hosted browser egress IP to your test environment's firewall allowlist.
For a field that accepts a single IP address, copy:

```text theme={null}
20.14.51.42
```

For an allowlist that accepts CIDR notation, copy:

```text theme={null}
20.14.51.42/32
```

### Set a user agent string

If your test environment allows traffic by user agent, tell Mo to use the string
your rule expects. For example, add this instruction to your brief:

```text theme={null}
Set the browser user agent to Momentic-Mo-QA before opening https://staging.example.com.
```

Configure your test environment to allow that same value:

```text theme={null}
Momentic-Mo-QA
```

This is a custom value you ask Mo to set. Mo uses a Chrome user agent by
default. A user agent can be copied by other clients, so it does not
authenticate Mo's traffic.

### Connect a local or private target

Start a tunnel for the addresses Mo needs, then pass the tunnel ID when you
start the session:

```bash theme={null}
tunnel_json=$(qa tunnel start localhost:3000 api.internal:8080)
tunnel_id=$(jq -r .tunnelId <<<"$tunnel_json")
qa start "Test the checkout flow on http://localhost:3000." --tunnel "$tunnel_id"
```

Keep the local URL in your brief. The tunnel gives Mo network access; provide
sign-in credentials too if the application requires them. Stop access with
`qa tunnel stop <tunnel-id>` when the session ends. See
[Mo tunnels](/docs/cli-reference/mo/commands/tunnel) for the command reference.

### Use an accessible address or change access settings

Give Mo a public or test URL it can open, or change your test environment's
firewall and deployment protection settings to permit its browser. If your
hosting provider supports a bypass token, provide the token and its required
HTTP header in the session chat.

After you provide access, tell Mo to retry the target. An accessible URL still
needs a test account if the flows you want tested require sign-in.