agent failed to complete authorized OAuth login for authenticated ZAP scan

TL;DR

OAuth login for a ZAP authenticated scan is a scripted browser flow: drive the authorization redirect, complete the login and consent steps, capture the tokens from the redirect, and hand ZAP a working session. The fragile parts are redirect handling and token capture, so verify each hop and confirm the final session with an authenticated probe before launching the scan.

agent failed to complete authorized OAuth login for authenticated ZAP scan

Use this when

• ZAP's authenticated scan runs anonymous against an OAuth-protected app.
• The agent's login script dies on a redirect or consent screen.
• The app is in your authorized engagement with an approved OAuth client.

Not for this skill when

• The OAuth client is misconfigured (wrong redirect URI, wrong scopes). Fix the client registration first.
• The app uses form login, not OAuth. That is the form-login skill, not this one.
• The app is outside your authorized engagement. Do not script its login.

Steps

1. Map the flow manually once: authorization endpoint, login page, consent screen, redirect back, token delivery. Verify: you can list every hop in order.
2. Script the flow in a real browser session, waiting for each page to settle before interacting. Verify: the script logs each completed hop.
3. Capture the tokens at the redirect: read them from the redirect URL or the token endpoint response, depending on the flow. Verify: the captured token has the expected scopes.
4. Transfer the session to ZAP using its authentication configuration for the context, with the captured tokens. Verify: ZAP's session shows as authenticated.
5. Probe an authenticated endpoint through ZAP before launching the scan. Verify: the probe returns authorized content; only then start the scan.

Variant phrasings

zap authenticated scan oauth setup

Common phrasing.

agent oauth login flow automation

Agent-workflow phrasing.

oauth redirect handling in login script

The usual failure point.

Compatibility: ZAP 2.12+ authentication configuration, OAuth 2.0 authorization code flow.

Why it happens

OAuth spreads login across multiple origins and redirects, and agents script it as if it were one form. Consent screens, redirect URI matching, and token-in-URL vs token-by-exchange differences each break a naive script at a different hop, and the agent reports "login failed" without saying which hop died.

Edge cases / pitfalls

• Short-lived authorization codes expire fast. Capture and exchange promptly; do not pause mid-flow.
• Consent screens may require a human click per the engagement's policy. If so, that hop is an approval gate with a timeout, not an automation step.
• Treat captured tokens as engagement secrets: never log their values, only their scopes and expiry.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_27N6bo7uSz9GptpghBJinw