Saved logins

Save a site’s cookies to load them into later sessions on your account. Cookie values are encrypted at rest and are not returned by the API. GET /v1/auth lists connected domains and update times. Saved logins are scoped to the registrable domain, such as linkedin.com.

POST /v1/session/{session_id}/save-auth

Save the session’s cookies for one site. The session’s current page must be on that site. Request: domain (for example httpbin.org) or url (a URL on the site); one of them is required.

curl -X POST https://back.tilion.dev/v1/session/sess_3d245e56b86d4bc8ae32095b644117d4/save-auth \
  -H "Authorization: Bearer ph_live_..." -H "Content-Type: application/json" \
  -d '{"domain": "httpbin.org"}'

Response (200):

{"ok": true, "domain": "httpbin.org", "cookies_saved": 1, "entry_id": "ea8e02bf7c7e4677b3f65445e7db133e"}

Errors: 400 domain (or url) is required; 400 auth domain does not match current page when the session is on another site; 400 no scoped auth cookies to save when the page set no cookies for that domain; 502 Data Plane auth save failed.

GET /v1/auth

The sites your account has saved logins for.

{"connected": [{"domain": "httpbin.org", "updated_at": "2026-10-19T14:39:02.324765+00:00"}]}

With nothing saved: {"connected": []}.

POST /v1/auth/import

Bring your own cookies: paste a session cookie from a browser where you are already logged in, and your sessions start authenticated on that site. Request:

Field	Type	Meaning
`domain`	string, required	The site.
`cookies`	list of up to 100 `{name, value, domain?, path?, expires?, httpOnly?, secure?, sameSite?}`	Full cookie objects. `domain` defaults to `.` plus the registrable domain, `path` to `/`.
`token`	string	Shorthand for one session cookie instead of `cookies`.
`cookie_name`	string	Name for `token` (default `li_at`).

curl -X POST https://back.tilion.dev/v1/auth/import \
  -H "Authorization: Bearer ph_live_..." -H "Content-Type: application/json" \
  -d '{"domain": "example.net", "cookies": [{"name": "session", "value": "s3cret", "domain": ".example.net", "path": "/", "httpOnly": true, "secure": true}]}'

Response (200): {"ok": true, "domain": "example.net", "cookies_saved": 1}. The shorthand {"domain": "example.org", "token": "abc123", "cookie_name": "sid"} answers {"ok": true, "domain": "example.org", "cookies_saved": 1}. Errors: 400 domain is required; 400 provide cookies:[...] or token:'<value>'; 400 incomplete_cookie_set (have, need) for a LinkedIn import with li_at but no JSESSIONID; 400 too many cookies (max 100); 400 no usable cookies in the request. A 200 with ok: false and cookies_saved: 0 means none of the cookies belonged to that domain.

{"detail": {"error": "incomplete_cookie_set", "message": "LinkedIn needs BOTH li_at and JSESSIONID (the CSRF token must match JSESSIONID). ...", "have": ["li_at"], "need": ["li_at", "JSESSIONID"]}}

DELETE /v1/auth/{domain}

Forget a saved login everywhere, including any copy that automatic unblocking could have reused. Response (200): {"ok": true, "domain": "httpbin.org", "data_plane_grants_retired": 1}. The last field, present only when it is non-zero, counts stored grants that were retired as well. A second delete answers 404 no saved login for httpbin.org.

Get started

Account

Sessions

Reading pages

Automation

MCP

POST /v1/session/{session_id}/save-auth

GET /v1/auth

POST /v1/auth/import

DELETE /v1/auth/{domain}

​POST /v1/session/{session_id}/save-auth

​GET /v1/auth

​POST /v1/auth/import

​DELETE /v1/auth/{domain}

POST /v1/session/{session_id}/save-auth

GET /v1/auth

POST /v1/auth/import

DELETE /v1/auth/{domain}