## TL;DR
OAuth login for a ZAP authenticated scan is a scripted browser flow: drive the authorization redirect, complete the login and consent steps, capture the tokens from the redirect, and hand ZAP a working session. The fragile parts are redirect handling and token capture, so verify each hop and confirm the final session with an authenticated probe before launching the scan.

```text
agent failed to complete authorized OAuth login for authenticated ZAP scan
```

## Use this when
- ZAP's authenticated scan runs anonymous against an OAuth-protected app.
- The agent's login script dies on a redirect or consent screen.
- The app is in your authorized engagement with an approved OAuth client.

## Not for this skill when
- The OAuth client is misconfigured (wrong redirect URI, wrong scopes). Fix the client registration first.
- The app uses form login, not OAuth. That is the form-login skill, not this one.
- The app is outside your authorized engagement. Do not script its login.

## Steps
1. Map the flow manually once: authorization endpoint, login page, consent screen, redirect back, token delivery. Verify: you can list every hop in order.
2. Script the flow in a real browser session, waiting for each page to settle before interacting. Verify: the script logs each completed hop.
3. Capture the tokens at the redirect: read them from the redirect URL or the token endpoint response, depending on the flow. Verify: the captured token has the expected scopes.
4. Transfer the session to ZAP using its authentication configuration for the context, with the captured tokens. Verify: ZAP's session shows as authenticated.
5. Probe an authenticated endpoint through ZAP before launching the scan. Verify: the probe returns authorized content; only then start the scan.

## Variant phrasings
### zap authenticated scan oauth setup
Common phrasing.
### agent oauth login flow automation
Agent-workflow phrasing.
### oauth redirect handling in login script
The usual failure point.

Compatibility: ZAP 2.12+ authentication configuration, OAuth 2.0 authorization code flow.

## Why it happens
OAuth spreads login across multiple origins and redirects, and agents script it as if it were one form. Consent screens, redirect URI matching, and token-in-URL vs token-by-exchange differences each break a naive script at a different hop, and the agent reports "login failed" without saying which hop died.

## Edge cases / pitfalls
- Short-lived authorization codes expire fast. Capture and exchange promptly; do not pause mid-flow.
- Consent screens may require a human click per the engagement's policy. If so, that hop is an approval gate with a timeout, not an automation step.
- Treat captured tokens as engagement secrets: never log their values, only their scopes and expiry.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_27N6bo7uSz9GptpghBJinw