## TL;DR
When an agent run to open the developer portal certificates page hits this failure - stuck on the login page with an error - do not retry the same step blindly. First check the real state in the Apple developer portal to learn whether the step already took effect, then stop driving the login page with browser automation and switch the workflow to the official API with a stored API key or service account, which has no interactive sign-in or two-factor step; reserve the browser for the few tasks no API covers, and hand those to a human. That sequence prevents duplicate uploads, corrupted release state and silent half-finished releases.

```text
browser automation failed on developer portal certificates page: agent stuck on the login page with error
```

## Use this when
- An automated release run to open the developer portal certificates page failed with this pattern.
- The workflow uses the Apple developer portal and the failure appeared mid-run, after earlier steps may already have applied.
- You are hardening a mobile release agent before its next unattended run.

## Not for this skill when
- A human running the same step manually in a terminal or console succeeds. That points at the underlying tool, not the agent wrapper.
- The store rejected the release on policy or metadata grounds. That is a store review issue, not an agent reliability failure.

## Steps
1. Stop the browser run and confirm by hand whether the account itself can sign in, separating an account problem from an automation problem. Verify: manual sign-in succeeds, or an account issue is identified and fixed first
2. Inventory what the browser step was doing on the certificates page and find the official API equivalent in the Apple developer portal: uploads, status, testers and releases are all API-covered in modern store tooling. Verify: each browser action is mapped to an API call or marked as genuinely console-only
3. Create the API credential the workflow needs, an App Store Connect API key or a Play service account, and store it in the CI or agent secret store. Verify: the credential exists and a read-only API call with it succeeds
4. Rewrite the step to call the API and remove the browser login from the unattended path. Verify: the workflow no longer opens a login page
5. Keep a short human checklist for any console-only remainder, such as agreements or identity checks, instead of automating around two-factor. Verify: the checklist exists in the release runbook
6. Run the full workflow to open the developer portal certificates page end to end. Verify: the run completes with no browser sign-in step
7. Record the fix in the release runbook or the CI job notes, naming the error, the value or setting that changed, and the date, so the next release engineer does not re-diagnose it from scratch. Verify: the runbook or job notes contain an entry for this error that a teammate can find by searching the error text

## Why it happens
Store web consoles are built for humans: two-factor prompts, session expiry and UI changes break automation unpredictably, and the login page is where every one of those defences concentrates. The vendor APIs exist specifically so release automation never needs to log in through a browser.

In practice this failure is rarely a one-off. It tends to recur at the worst point in the release cycle, when a certificate, a toolchain, a store policy or a team process has quietly changed since the last successful release and nobody connected that change to the release pipeline. That is why the steps above insist on reading the actual store, portal or build state at each point instead of trusting configuration files or memory: the configuration usually describes the release the team intended to ship, while this error describes the release the systems actually see. Once the immediate upload or build is unblocked, treat the underlying drift as the real defect. Pin the toolchain version, expiry date, identifier or policy value that caused it in the release checklist, and add the cheapest automatic check that would have caught it before submission day, for example a preflight lane that validates signing, versions and metadata lengths before the full archive runs. A release pipeline that fails in preflight costs minutes; the same failure discovered at submission costs a day.

## Variants and edge cases
### agent failed to open the developer portal certificates page reliability playbook
The workflow-hardening phrasing: state checks, budgets and resumability for this step. When you land on this skill from that phrasing, start at step 1 rather than jumping to the most dramatic fix: the early steps are cheap state checks that confirm you are solving the failure you actually have, and they take minutes compared with a rebuild or a store-side change you cannot undo.
### the Apple developer portal agent workflow failure recovery
The recovery phrasing: establish real store state first, then resume without duplicating applied steps. When you land on this skill from that phrasing, start at step 1 rather than jumping to the most dramatic fix: the early steps are cheap state checks that confirm you are solving the failure you actually have, and they take minutes compared with a rebuild or a store-side change you cannot undo.
### Edge case: partial application
The hardest variant of every agent failure is the half-applied release. Always reconcile store state before resuming, even when the log looks clean. When you land on this skill from that phrasing, start at step 1 rather than jumping to the most dramatic fix: the early steps are cheap state checks that confirm you are solving the failure you actually have, and they take minutes compared with a rebuild or a store-side change you cannot undo.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_MzgUtMyx1GBXkFKI8R-PPw