> ## Documentation Index
> Fetch the complete documentation index at: https://docs.champ.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Set up a managed profile

> Store credentials once and let Champ log in (and re-authenticate) for you

A **browser profile** is a reusable, logged-in browser session that your workflows attach to when they act inside a
website. With **Managed Authentication** on, you store credentials once and the agent logs in for you, re-authenticating
automatically when the session expires. (Left off, the profile is manual — you log in live and Champ saves the session.)

For sites with two-factor authentication, finish with [Email 2FA](/browser-profiles/email-2fa) or
[SMS 2FA via Twilio](/browser-profiles/sms-2fa). Setting up a fresh account for Champ to use? Generate a
[Champ email address](/browser-profiles/champ-email-address) and sign up with it — verification emails and 2FA codes
then land in Champ directly.

## Create a managed profile

1. In the sidebar, open **Integrate → Browser Profiles** and click **Add Profile**.
2. Give it a **Name** and the **Login URL** (where the browser opens to log in).
3. Turn on **Managed Authentication** and provide credentials one of two ways:
   * **1Password** — pick a vault and item. Champ reads the username, password (and TOTP, if present) at login time;
     nothing is copied into Champ.
   * **Manual** — type a **Username / Email** and **Password** directly.

<Note>
  Credentials are encrypted at rest and only readable by the tenant that created the profile. When editing, leave the
  password blank to keep the current one.
</Note>

## Choose a two-factor method

Under **Two-factor authentication**, pick how Champ obtains the second-factor code:

| Method        | When to use                                                              |
| ------------- | ------------------------------------------------------------------------ |
| **None**      | The site has no second factor.                                           |
| **Email**     | The site emails a code. → [Email 2FA](/browser-profiles/email-2fa)       |
| **SMS**       | The site texts a code. → [SMS 2FA via Twilio](/browser-profiles/sms-2fa) |
| **1Password** | The selected 1Password item carries a TOTP (authenticator) field.        |

## Save and test

New managed profiles default to **Create & Test**: Champ saves a draft and immediately runs a real login to verify the
credentials and 2FA path. A profile that logs in successfully becomes **active**; use **Create without testing** to
verify later from the profile row. You can re-run the test anytime.

During login the agent enters the username and password (`x_user` / `x_pass`), waits for the 2FA code if one is set, then
submits it (`x_otp_code`). If the site doesn't challenge for a code this session, the agent treats that as success and
proceeds. Both prompts can be customized under **Customize prompts**, but the defaults work for most sites.

## When a session expires

When a managed session expires, Champ first tries to re-authenticate automatically using the stored credentials and 2FA
method — no action needed on your part. Only if that automatic re-login fails does Champ email the addresses under
**Advanced → Notification Emails**. The email links back to the profile, where you can re-authenticate in a live browser
and resume any waiting runs.