How to test a login flow automatically

Login fails quietly

A broken login looks like a normal form. The page loads, the fields are there, and the button submits. Then the session never starts. The redirect URL was dropped, the API returned an error the UI swallowed, or the success screen changed its heading and nobody noticed. People who are already logged in on your laptop will not see it. A customer on a fresh browser will.

An automatic check is a test account plus a sentence that only exists after login. It is not a scan of every user, and it is not a password auditor. One account, one path, on a schedule, is the whole tool. Signup is a different path: it creates a user. Login proves an existing user can get back in.

The account you should use

Create a user that exists only for this check. Give it an inbox you control and a password you can lose. Do not use your own admin, and do not use a customer. The flow will type that password on a schedule, and the steps are stored so the run can repeat. A customer password in a step is a leak you created for yourself.

If login requires a second factor, a captcha, or a passkey, a short script will stop there. That is a property of the login, not a bug in the check. Either use a test user that does not have that step, or accept that this path has to be checked by hand. Do not weaken the real login so a monitor can skip a control your customers still face, unless the test user is clearly separate.

Steps that mean login worked

Visit the published /login URL, not the preview. Fill the email field by its label. Fill the password field by its label. Click the button's real words, such as Log in. Expect a sentence that is absent on the logged-out page. The product name in the header is a bad expectation if the logged-out page shows it too. A heading from the signed-in home, or the test user's email printed in the account menu, is a better one.

The click looks for a button, a link, or other text. If the control is an icon with no name, the step will not find it. Give the button an accessible name, or expect text you can point at. After a failure, the run stores the step and a screenshot. Read those before you change the app. The expected sentence may simply be stale.

Run the pass once while you watch. If the test user lands on an interstitial you forgot, such as a terms checkbox or a 'verify your email' wall, the expected sentence never appears and the check will fail every day. Either complete that step in the flow or use a test user who is already past it. A check you have seen pass once is worth more than a script you only imagined.

Password login and email login

A password check finishes in one run: type, click, expect. A magic-link check has a second half. The form submits, a message arrives, and the link has to be opened. WhoopsBot can wait for a message to the flow's own inbox on Starter and Pro. The free plan does not include email-arrival steps. If your product's only login is a magic link, the free plan can still click the form and expect your 'check your email' sentence. It cannot open the link.

Password reset is a third path. Do not treat a successful login as proof that reset works. Reset depends on the mail provider and on the redirect allow list, which is the same class of bug as a confirmation mail that points at localhost. Test it when you change auth settings, with an address you control.

How often, and what you get

The free plan runs one flow once a day. The result stays on the run page. There is no email on that plan. Starter is $19 USD a month: five flows, about every six hours, an email when a flow starts failing, and a weekly report. Pro is $49 USD a month: twenty flows, every hour, an email every time a check fails. You can cancel from the billing page. The first payment is refunded in full within 14 days if you ask.

Before you schedule login, paste the login URL into the free page check. That look reports load failures, console errors, and a few obvious secrets in the JavaScript. It does not type the password. If the page itself throws, fix that first. Then save the flow. A green login check means this test user saw the sentence you named. It does not mean every account in the database can log in.