Sign in and fill a form

In this guide we sign in to a practice website, check that it worked, and report the result. You'll also learn the two ways to handle sign-ins on real sites: let the flow type the password, or sign in once by hand and let the browser remember you.

What you build: Manual → Open URL → Fill a form → Wait for URL → (Matched) Extract → Notify, or (Timeout) Screenshot → Notify

The website: https://the-internet.herokuapp.com/login, a public practice page for automation. It shows its own test login on the page: username tomsmith, password SuperSecretPassword!. A good sign-in takes you to /secure.

Step 1: Keep the password out of the flow

Never type a password straight into a node. Store it once as a secret variable:

1. In the sidebar, open Dataset › Variables.
2. Press Add variable.
3. Name: demo_password. Value: SuperSecretPassword!.
4. Turn on Secret, then save.

Flows read it as {{ vars.demo_password }}. After saving, the value stays hidden, even from you. Anyone who opens or exports the flow sees only the variable's name.

For a real account on 𝕏, Threads, Facebook or Shopee, add it in Dataset › Account instead. Its password and 2FA are stored encrypted. The platform nodes and templates use it.

Step 2: Open the sign-in page

1. Studio › Flows › New flow, name it Sign in, then Create.
2. Add first step › Manual.
3. + › Open URL, URL https://the-internet.herokuapp.com/login.

Step 3: Fill the form and send it

Fill a form types, picks and checks every field in one node, then clicks the button.

1. + on Open URL's Next › Fill a form.
2. Under Fields, add two rows:

3. Then click (selector): button[type=submit].
4. Leave Type like a person on. It types with natural pauses, so sites don't see a bot pasting text.

The log says Filled 2 fields and sent the form.

Other things Do can do: Pick an option (a dropdown), Check and Uncheck (checkboxes), and Attach a file (an upload field, the value being a file key).

Step 4: Check that it worked

A sign-in "works" when the site takes you somewhere new. Wait for URL waits for that.

1. + on Fill a form's Next › Wait for URL.
2. URL contains (or /regex/): /secure.
3. Timeout (ms): 15000.

It has two dots: Matched (signed in) and Timeout (still on the sign-in page after 15 seconds).

Step 5: Report both outcomes

When it worked:

1. + on Matched › Extract, Mode Text, Element #flash.
2. + on its Next › Notify: Title Signed in, Message {{ nodes.extract.output.value }}, Level success.

When it didn't:

1. + on Timeout › Screenshot, with Whole page on.
2. + on its Next › Notify: Title Sign-in failed, Message Still on {{ nodes.open.output.url }}, Level error.

The screenshot is saved with the run. Open the Screenshot node's Output to see the page as the flow saw it.

Step 6: Test it

Press Test run and open the Preview window to watch it type. You get Signed in with You logged into a secure area!.

Now try the failure path: change the variable's value to something wrong and run again. You get Sign-in failed with a screenshot of the error message.

Real sites: sign in once by hand

Many sites ask for a code, a captcha or a phone check on sign-in. You don't need to automate that. A Mooflair browser is a real Chrome profile that keeps its cookies between runs, so you sign in once and the flow stays signed in.

1. Hover the first browser node (Open URL) and press the window icon (Open browser). The flow's browser opens in the Preview window, without a run.
2. In the Preview's ⋯ menu, turn on Take control.
3. Go to the site and sign in like you normally would: type the code, solve the captcha, scan the QR code.
4. Close the Preview. The sign-in stays in that browser.

Your flow can now skip the sign-in steps and start at the page it needs.

For a campaign's browsers, do the same from Operate › Browsers: press Live on the browser, then Take control.

Let the flow ask you for help

When a site sometimes shows a captcha, add an Intervention node where it can appear:

• Message: Solve the captcha, then press Done.
• Solved when visible: a selector that only shows once you're through, like #dashboard.

The run pauses with Needs you, the Preview opens on that browser with control on, and the run checks by itself every few seconds. Once the selector shows up, it goes on.

Any node can do this on failure too: in its Settings tab, set On error to Ask a human.

Next: .

FAQ

Is it safe to put my password in a flow?

Put it in a Secret variable (Dataset › Variables) or an account (Dataset › Account), never in a node field. Both are stored encrypted, and neither shows up in a flow export.

Do I have to sign in on every run?

No. The browser keeps its cookies between runs, like your own Chrome. Sign in once by hand (above) and later runs find you signed in, until the site signs you out.

The site asks for a 2FA code. Can the flow type it?

Yes, if you have the account's 2FA secret (the text under the QR code). The 2FA code node makes the current code from it. Type it with Type or Fill a form. Otherwise, sign in once by hand.

Why use Wait for URL instead of just checking for an element?

After you send a form, the page reloads or goes somewhere else. Waiting for the new address is the clearest signal that the sign-in went through. If the address doesn't change on your site, use Wait for element with something that only shows when you're signed in.