From 4439365bfc58cd601b703bc3456d363abf7324aa Mon Sep 17 00:00:00 2001 From: tnsardesai <18272584+tnsardesai@users.noreply.github.com> Date: Mon, 14 Sep 2026 23:55:41 +0000 Subject: [PATCH] Document managed auth regions --- auth/configuration.mdx | 72 ++++++++++++++++++++++++++++++++++ browsers/regions.mdx | 33 +++++++++++++++- changelog.mdx | 1 + reference/cli/managed-auth.mdx | 3 ++ 4 files changed, 108 insertions(+), 1 deletion(-) diff --git a/auth/configuration.mdx b/auth/configuration.mdx index b2e82846..4f849955 100644 --- a/auth/configuration.mdx +++ b/auth/configuration.mdx @@ -96,6 +96,77 @@ _ = auth ``` +## Browser Region + +Set `browser.region` to choose where Managed Auth runs the connection's initial login, health checks, and automatic reauthentication. Choose from `us-east`, `eu-west`, and `ap-southeast`. Region selection is available on [Start-Up and Enterprise plans](/info/pricing); omitted values default to `us-east`. + + +```typescript TypeScript +const auth = await kernel.auth.connections.create({ + domain: 'example.com', + profile_name: 'my-profile', + browser: { region: 'eu-west' }, +}); +``` + +```python Python +auth = await kernel.auth.connections.create( + domain="example.com", + profile_name="my-profile", + browser={"region": "eu-west"}, +) +``` + +```go Go +auth, err := client.Auth.Connections.New(ctx, kernel.AuthConnectionNewParams{ + ManagedAuthCreateRequest: kernel.ManagedAuthCreateRequestParam{ + Domain: "example.com", + ProfileName: "my-profile", + Browser: kernel.ManagedAuthBrowserConfigParam{ + Region: kernel.ManagedAuthBrowserConfigRegionEuWest, + }, + }, +}) +if err != nil { + panic(err) +} +_ = auth +``` + + +Updating `browser.region` changes the connection default for browsers created afterward. It doesn't move or restart an active login, health check, or reauthentication browser. + +You can override the connection region for one login without changing its default: + + +```typescript TypeScript +const login = await kernel.auth.connections.login(auth.id, { + browser: { region: 'ap-southeast' }, +}); +``` + +```python Python +login = await kernel.auth.connections.login( + auth.id, + browser={"region": "ap-southeast"}, +) +``` + +```go Go +login, err := client.Auth.Connections.Login(ctx, auth.ID, kernel.AuthConnectionLoginParams{ + Browser: kernel.ManagedAuthBrowserConfigParam{ + Region: kernel.ManagedAuthBrowserConfigRegionApSoutheast, + }, +}) +if err != nil { + panic(err) +} +_ = login +``` + + +Browser placement and proxy location are independent. `browser.region` chooses where the browser runs; the connection's [proxy](/proxies/overview) controls the exit IP that websites see. Regional browsers don't provide a data residency guarantee. See [Regional Browsers](/browsers/regions) for storage and processing details. + ## SSO/OAuth Support Managed Auth supports common "Sign in with Google/GitHub/Microsoft" flows. The user completes the OAuth flow with the provider, and Kernel saves the authenticated session to the profile. Automatic reauthentication depends on the provider's login requirements. See [Can this connection auto-reauth?](/auth/connection-lifecycle#can-this-connection-auto-reauth) for how Kernel determines eligibility. @@ -375,6 +446,7 @@ After creating a connection, you can update its configuration with `auth.connect | `auto_reauth` | Whether a failed scheduled health check is allowed to attempt automatic re-authentication | | `save_credentials` | Whether to save credentials on successful login | | `record_session` | Record a [replay](/browsers/replays) of every auth browser session for this connection (logins, health checks, and reauths) | +| `browser.region` | Region for login, health-check, and reauth browsers. Takes effect on the next browser created for the connection | | `proxy` | Pin login, health-check, and reauth sessions to a proxy. Takes effect on the next health check or reauth | Only the fields you include are updated—everything else stays the same. Changes to `health_check_interval`, `health_checks`, `auto_reauth`, and `proxy` take effect immediately on the running connection. diff --git a/browsers/regions.mdx b/browsers/regions.mdx index 20242f35..3b0ad233 100644 --- a/browsers/regions.mdx +++ b/browsers/regions.mdx @@ -12,7 +12,7 @@ Choose from `us-east`, `eu-west`, and `ap-southeast`. Region selection is available on [Start-Up and Enterprise plans](/info/pricing), at the same usage rates as default browsers. If you omit `region` when creating a browser or pool, it defaults to `us-east`. -Regional browsers support CPU browsers and browser pools. Regional support for GPU browsers, Managed Auth, Apps, and Invocations is coming soon. +Regional browsers support CPU browsers, browser pools, and Managed Auth. Regional support for GPU browsers, Apps, and Invocations is coming soon. ## Create a regional browser @@ -76,6 +76,37 @@ You can also choose **Region** in the browser configuration dialog in the [dashb A browser's region is fixed when you create it. To use a different region, create a new browser. +## Run Managed Auth in a region + +A Managed Auth connection stores a default browser region for its initial login, health checks, and automatic reauthentication. In the dashboard, choose **Region** under **Advanced options** when you create a connection, or under **Browser defaults** when you edit one. + +With the CLI, pass `--region` when you create or update a connection: + +```bash +kernel auth connections create \ + --domain example.com \ + --profile-name my-profile \ + --region eu-west + +kernel auth connections update conn_01k3m8v2c9w4n7q6 \ + --region ap-southeast +``` + +For one login in a different region, pass `--region` to `kernel auth connections login`. The override applies only to that login. + +The MCP server exposes the same behavior through `browser_region` on `manage_auth_connections`: + +```json +{ + "action": "create", + "domain": "example.com", + "profile_name": "my-profile", + "browser_region": "eu-west" +} +``` + +For the secure login panel, pass `region` to `open_auth_login`. See [Connection Configuration](/auth/configuration#browser-region) for SDK examples and update semantics. + ## Create a regional browser pool Set `region` when creating a pool, or choose **Region** in the dashboard's pool creation dialog: diff --git a/changelog.mdx b/changelog.mdx index 8d5a1171..15dbd844 100644 --- a/changelog.mdx +++ b/changelog.mdx @@ -24,6 +24,7 @@ For API library updates, see the [Node SDK](https://github.com/onkernel/kernel-n - Documented [Vaults](/vaults) and [browser payments](/integrations/payments/overview), including checkout and payment-processor support, app-invocation billing, and Vault payment security guidance, and added them to the [pricing page](/info/pricing). - Added a new [Cookbooks](/cookbooks) tab with 13 end-to-end recipes — AI SDK, Browser Use, Claude computer use and managed agents, e2b, Eve x Foreman, Eve x Managed Auth, Mastra, Modal, Stagehand, Tinker, and Vibium — plus a Common Patterns section for the Playwright computer-use fallback and browser payments. - Added regional browsers to the [pricing page](/info/pricing). +- Added regional placement to [Managed Auth](/auth/configuration#browser-region). Set a connection default or override one login through the SDK, dashboard, CLI, or MCP server; health checks and automatic reauthentication use the connection's region. - Added a canonical [network access allowlist](/info/network-access) reference for configuring egress. diff --git a/reference/cli/managed-auth.mdx b/reference/cli/managed-auth.mdx index 966906ca..5dfcd239 100644 --- a/reference/cli/managed-auth.mdx +++ b/reference/cli/managed-auth.mdx @@ -19,6 +19,7 @@ Create a managed auth connection for a profile and domain. | `--health-check-interval ` | Seconds between health checks (300–86400). | | `--no-health-checks` | Disable periodic health checks. | | `--no-auto-reauth` | Disable automatic reauthentication attempts after an expired session is detected. | +| `--region ` | Browser region for login, health-check, and reauthentication sessions: `us-east`, `eu-west`, or `ap-southeast`. Defaults to `us-east`. | | `--proxy-id ` | Proxy ID to use. | | `--proxy-name ` | Proxy name to use. | | `--credential-provider ` | External credential provider name. | @@ -52,6 +53,7 @@ Start a login flow and return a hosted URL for authentication. | Flag | Description | |------|-------------| +| `--region ` | Region override for this login only. Omit it to inherit the connection region. | | `--proxy-id ` | Proxy ID to use for this login. | | `--proxy-name ` | Proxy name to use for this login. | | `--telemetry ` | Override telemetry for this login only, merged with the connection's config. Pass `all`, `off`, or a comma-separated category list like `console,network`. | @@ -110,6 +112,7 @@ Update connection settings such as login URL, health checks, credential source, | `--health-check-interval ` | Seconds between health checks. | | `--health-checks` / `--no-health-checks` | Enable or disable periodic health checks. | | `--auto-reauth` / `--no-auto-reauth` | Enable or disable automatic reauthentication attempts after an expired session is detected. | +| `--region ` | Region for browser sessions created after the update: `us-east`, `eu-west`, or `ap-southeast`. Active sessions don't move. | | `--proxy-id ` | Proxy ID to use. | | `--proxy-name ` | Proxy name to use. | | `--credential-provider ` | External credential provider name. |