Autonomous login: Google & X/Twitter.

An agent that can log into services on its own without user help is a truly independent agent. This requires special setup: proper credentials, browser automation, and 2FA handling.

Many services the agent needs — email, cloud, social media — require login. If the agent has to ask for user help every time a session expires, autonomy breaks. The key: set up credentials and browser automation so the agent can log in and maintain sessions on its own.

Google Login

Google is one of the most important logins because many services depend on it: Gmail, Google Cloud, YouTube, Google Drive. Google has several authentication layers to handle: password, 2FA (TOTP), and recovery codes.

What to prepare

Google login flow

The agent must follow this flow in order. Each step has a different failure potential:

1. Buka browser → navigasi ke accounts.google.com
2. Masukkan email → klik Next
3. Masukkan password → klik Next
4. Jika diminta 2FA:
   a. Generate TOTP code dari secret key (pyotp)
   b. Masukkan 6 digit code → klik Next
   c. Jika TOTP gagal, pakai backup code
5. Verifikasi login berhasil (cek cookies/session)
6. Simpan session cookies untuk reuse

Generating TOTP autonomously

TOTP (Time-based One-Time Password) can be generated locally without Google Authenticator. All that's needed is the secret key from the 2FA setup. With Python and pyotp, the agent can generate a code anytime:

import pyotp

# Secret key dari setup 2FA Google
secret = "JBSWY3DPEHPK3PXP"
totp = pyotp.TOTP(secret)

# Generate 6 digit code yang valid selama 30 detik
code = totp.now()  # misalnya: "483291"

Session persistence

After a successful login, save the browser cookies. These cookies can be reused in later sessions without logging in again. Google session cookies usually last weeks to months. The agent must detect when a session expires (HTTP 401 or redirect to login page) and perform automatic re-login.

X / Twitter Login

X/Twitter supports several authentication methods the agent can use autonomously. A good setup provides more than one method so the agent has a fallback if the primary method fails.

Method 1: Cookie-based (most stable)

Log in once in a regular browser, export cookies, then the agent uses those cookies for all operations. This is the most stable method because cookies last a long time and aren't affected by anti-bot detection.

Cookies are stored in a JSON file, for example ~/.agent/credentials/x-cookies.json. With valid cookies, the agent can perform all operations: posting, delete, reply, like, retweet, follow, unfollow, search, DM, bookmarks, polls, scheduled tweets, lists, media upload, and more. This is the primary method because it covers almost all needs.

Metode 2: Username & password

The agent logs in directly with username and password. Credentials are stored in a separate file, for example ~/.agent/credentials/x-auth.env containing username, password, and backup code for handling 2FA.

Backup codes are critical for autonomous login. When X requests a verification code (2FA), the agent can enter the backup code without user help. Without backup codes, the agent gets stuck on the 2FA page and has to wait for the user.

When to use which method?

Use cookie-based as the primary method because it's most stable and covers all operations without being affected by anti-bot. Save cookies after the first manual login.

Use username/password + backup code as a fallback: when cookies expire and the agent needs to re-login, or when initial setup is done remotely without manual browser access. Make sure backup codes are always saved so the agent doesn't get stuck at 2FA.

General principles of autonomous login