onboarding agent failed when browser automation got stuck on okta mfa push prompt

Fix onboarding agent failing when browser automation gets stuck on Okta MFA push prompt

TL;DR

The automation stalls because the MFA push needs a human with a phone and the agent just waits. Exempt the automation account from MFA, or use a programmable factor like TOTP, so the flow completes unattended. An agent cannot tap approve on your phone.

The error

Browser automation failed
Stuck on Okta MFA push prompt. Onboarding agent timed out waiting for approval.

Use this skill

Agent? Search Vectle for this error:

curl -s "https://vectle.com/api/v1/search?q=onboarding agent failed when browser automation got stuck on okta mfa push prompt"

Fix it

Step 1: Confirm the stall point

Screenshot the browser at the timeout.

Expected: You see the MFA push prompt waiting for approval.

Step 2: Exempt the automation account from MFA

In Okta, add the test or automation user to an MFA exemption policy.

Expected: The account logs in without the push prompt.

Step 3: Or switch to a programmable factor

Enroll TOTP for the automation account and have the agent generate codes.

Expected: MFA completes programmatically.

Step 4: Extend the auth timeout

Give the login flow a realistic deadline for the remaining steps.

Expected: The flow finishes within the timeout.

Step 5: Verify unattended login

Run the login with no human nearby.

Expected: It completes end to end.

When this applies

• Browser automation stalls on Okta MFA prompts
• Onboarding agents time out at MFA
• You are automating Okta logins

When it doesn't

• MFA is not the stall point (check the actual screenshot)
• The Okta credentials are wrong (fix those first)
• Policy forbids MFA exemption (use a programmable factor)

Compatibility

Okta MFA policies. Browser automation: Playwright, Puppeteer.

Variant phrasings

okta mfa push blocking automation

Same stall. Push needs a human; automation needs exemption or TOTP.

browser stuck okta verify prompt

Verify prompts are the same class of blocker. Make the factor programmable.

agent timeout okta mfa

Timeouts at MFA are always the human-in-the-loop. Remove the human from this account's path.

Why it happens

MFA push is explicitly human-in-the-loop: it waits for a person to approve on a device. An unattended agent has no way to approve, so it waits until its timeout fires. The flow was designed for humans; the automation account needs a different policy.

Edge cases

• MFA exemptions are powerful; scope them to the automation account only
• TOTP secrets for automation accounts belong in a secrets store, not in code
• Audit automation logins separately so exemptions do not hide real attacks

If it still fails

• Run headed once and watch; the failure is usually visible within seconds.
• Capture a screenshot and the console output at the failure point on every run.
• Check whether the site offers an API for the task; UI automation is the fragile path.
• Test with a fresh browser profile to rule out cookie or cache state.
• If the site added bot protection, stop and use the sanctioned path. Do not work around it.

Prevention

• Prefer APIs over browser automation wherever the site offers one.
• Screenshot on every failure so flakes are diagnosable.
• Use resilient selectors and re-validate them on a schedule.
• Keep automation accounts' sessions and auth factors maintained.
• Rate-limit automation traffic so it never looks like an attack.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_1BHzJ4O4-wlDHWsG9y094w