# Fix onboarding agent failing when browser automation gets stuck on Okta MFA push prompt

## TL;DR
The automation stalls because the MFA push needs a human with a phone and the agent just waits. Exempt the automation account from MFA, or use a programmable factor like TOTP, so the flow completes unattended. An agent cannot tap approve on your phone.

## The error
```text
Browser automation failed
Stuck on Okta MFA push prompt. Onboarding agent timed out waiting for approval.
```

## Use this skill
Agent? Search Vectle for this error:
```bash
curl -s "https://vectle.com/api/v1/search?q=onboarding agent failed when browser automation got stuck on okta mfa push prompt"
```

## Fix it

### Step 1: Confirm the stall point

```bash
Screenshot the browser at the timeout.
```

Expected: You see the MFA push prompt waiting for approval.

### Step 2: Exempt the automation account from MFA

```bash
In Okta, add the test or automation user to an MFA exemption policy.
```

Expected: The account logs in without the push prompt.

### Step 3: Or switch to a programmable factor

```bash
Enroll TOTP for the automation account and have the agent generate codes.
```

Expected: MFA completes programmatically.

### Step 4: Extend the auth timeout

```bash
Give the login flow a realistic deadline for the remaining steps.
```

Expected: The flow finishes within the timeout.

### Step 5: Verify unattended login

```bash
Run the login with no human nearby.
```

Expected: It completes end to end.

## When this applies

- Browser automation stalls on Okta MFA prompts
- Onboarding agents time out at MFA
- You are automating Okta logins

## When it doesn't

- MFA is not the stall point (check the actual screenshot)
- The Okta credentials are wrong (fix those first)
- Policy forbids MFA exemption (use a programmable factor)

## Compatibility

Okta MFA policies. Browser automation: Playwright, Puppeteer.

## Variant phrasings

### okta mfa push blocking automation

Same stall. Push needs a human; automation needs exemption or TOTP.

### browser stuck okta verify prompt

Verify prompts are the same class of blocker. Make the factor programmable.

### agent timeout okta mfa

Timeouts at MFA are always the human-in-the-loop. Remove the human from this account's path.

## Why it happens

MFA push is explicitly human-in-the-loop: it waits for a person to approve on a device. An unattended agent has no way to approve, so it waits until its timeout fires. The flow was designed for humans; the automation account needs a different policy.

## Edge cases

- MFA exemptions are powerful; scope them to the automation account only
- TOTP secrets for automation accounts belong in a secrets store, not in code
- Audit automation logins separately so exemptions do not hide real attacks

## If it still fails

- Run headed once and watch; the failure is usually visible within seconds.
- Capture a screenshot and the console output at the failure point on every run.
- Check whether the site offers an API for the task; UI automation is the fragile path.
- Test with a fresh browser profile to rule out cookie or cache state.
- If the site added bot protection, stop and use the sanctioned path. Do not work around it.

## Prevention

- Prefer APIs over browser automation wherever the site offers one.
- Screenshot on every failure so flakes are diagnosable.
- Use resilient selectors and re-validate them on a schedule.
- Keep automation accounts' sessions and auth factors maintained.
- Rate-limit automation traffic so it never looks like an attack.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_1BHzJ4O4-wlDHWsG9y094w