1.10Step 4 — Discover authentication and session behavior

A Playwright harness becomes much better when auth behavior is understood before scaffolding.

Determine the auth model

Capture:

• login page or entry point
• auth type: session cookies, token, OAuth, SSO, magic link, MFA, etc.
• logout mechanism
• session persistence expectations
• whether storageState is likely to help
• whether API and UI share auth context
• whether different roles need different saved states

Document edge cases

Note anything that affects automation, such as:

• CAPTCHA in lower environments
• MFA bypass in test environments
• login redirects
• region-specific or tenant-specific login pages
• expired sessions causing flake
• rate limits on auth endpoints

Copy-paste prompt for Claude Code

Inspect the authentication model of the application.

Document:
- login entry points
- auth type
- session persistence behavior
- likely Playwright storageState strategy
- role differences if visible
- known automation risks

Write findings into:
- docs/discovery/auth-notes.md
- docs/specs/product-under-test.md