Document managed auth regions

auth/configuration.mdx

@@ -96,6 +96,77 @@ _ = auth
 ```
 </CodeGroup>
 
+## Browser Region
+
+Set `browser.region` to choose where Managed Auth runs the connection's initial login, health checks, and automatic reauthentication. Choose from `us-east`, `eu-west`, and `ap-southeast`. Region selection is available on [Start-Up and Enterprise plans](/info/pricing); omitted values default to `us-east`.
+
+<CodeGroup>
+```typescript TypeScript
+const auth = await kernel.auth.connections.create({
+  domain: 'example.com',
+  profile_name: 'my-profile',
+  browser: { region: 'eu-west' },
+});
+```
+
+```python Python
+auth = await kernel.auth.connections.create(
+    domain="example.com",
+    profile_name="my-profile",
+    browser={"region": "eu-west"},
+)
+```
+
+```go Go
+auth, err := client.Auth.Connections.New(ctx, kernel.AuthConnectionNewParams{
+	ManagedAuthCreateRequest: kernel.ManagedAuthCreateRequestParam{
+		Domain:      "example.com",
+		ProfileName: "my-profile",
+		Browser: kernel.ManagedAuthBrowserConfigParam{
+			Region: kernel.ManagedAuthBrowserConfigRegionEuWest,
+		},
+	},
+})
+if err != nil {
+	panic(err)
+}
+_ = auth
+```
+</CodeGroup>
+
+Updating `browser.region` changes the connection default for browsers created afterward. It doesn't move or restart an active login, health check, or reauthentication browser.
+
+You can override the connection region for one login without changing its default:
+
+<CodeGroup>
+```typescript TypeScript
+const login = await kernel.auth.connections.login(auth.id, {
+  browser: { region: 'ap-southeast' },
+});
+```
+
+```python Python
+login = await kernel.auth.connections.login(
+    auth.id,
+    browser={"region": "ap-southeast"},
+)
+```
+
+```go Go
+login, err := client.Auth.Connections.Login(ctx, auth.ID, kernel.AuthConnectionLoginParams{
+	Browser: kernel.ManagedAuthBrowserConfigParam{
+		Region: kernel.ManagedAuthBrowserConfigRegionApSoutheast,
+	},
+})
+if err != nil {
+	panic(err)
+}
+_ = login
+```
+</CodeGroup>
+
+Browser placement and proxy location are independent. `browser.region` chooses where the browser runs; the connection's [proxy](/proxies/overview) controls the exit IP that websites see. Regional browsers don't provide a data residency guarantee. See [Regional Browsers](/browsers/regions) for storage and processing details.
+
 ## SSO/OAuth Support
 
 Managed Auth supports common "Sign in with Google/GitHub/Microsoft" flows. The user completes the OAuth flow with the provider, and Kernel saves the authenticated session to the profile. Automatic reauthentication depends on the provider's login requirements. See [Can this connection auto-reauth?](/auth/connection-lifecycle#can-this-connection-auto-reauth) for how Kernel determines eligibility.
@@ -375,6 +446,7 @@ After creating a connection, you can update its configuration with `auth.connect
 | `auto_reauth` | Whether a failed scheduled health check is allowed to attempt automatic re-authentication |
 | `save_credentials` | Whether to save credentials on successful login |
 | `record_session` | Record a [replay](/browsers/replays) of every auth browser session for this connection (logins, health checks, and reauths) |
+| `browser.region` | Region for login, health-check, and reauth browsers. Takes effect on the next browser created for the connection |
 | `proxy` | Pin login, health-check, and reauth sessions to a proxy. Takes effect on the next health check or reauth |
 
 Only the fields you include are updated—everything else stays the same. Changes to `health_check_interval`, `health_checks`, `auto_reauth`, and `proxy` take effect immediately on the running connection.

browsers/regions.mdx

@@ -12,7 +12,7 @@ Choose from `us-east`, `eu-west`, and `ap-southeast`.
 Region selection is available on [Start-Up and Enterprise plans](/info/pricing), at the same usage rates as default browsers. If you omit `region` when creating a browser or pool, it defaults to `us-east`.
 
 <Note>
-Regional browsers support CPU browsers and browser pools. Regional support for GPU browsers, Managed Auth, Apps, and Invocations is coming soon.
+Regional browsers support CPU browsers, browser pools, and Managed Auth. Regional support for GPU browsers, Apps, and Invocations is coming soon.
 </Note>
 
 ## Create a regional browser
@@ -76,6 +76,37 @@ You can also choose **Region** in the browser configuration dialog in the [dashb
 
 A browser's region is fixed when you create it. To use a different region, create a new browser.
 
+## Run Managed Auth in a region
+
+A Managed Auth connection stores a default browser region for its initial login, health checks, and automatic reauthentication. In the dashboard, choose **Region** under **Advanced options** when you create a connection, or under **Browser defaults** when you edit one.
+
+With the CLI, pass `--region` when you create or update a connection:
+
+```bash
+kernel auth connections create \
+  --domain example.com \
+  --profile-name my-profile \
+  --region eu-west
+
+kernel auth connections update conn_01k3m8v2c9w4n7q6 \
+  --region ap-southeast
+```
+
+For one login in a different region, pass `--region` to `kernel auth connections login`. The override applies only to that login.
+
+The MCP server exposes the same behavior through `browser_region` on `manage_auth_connections`:
+
+```json
+{
+  "action": "create",
+  "domain": "example.com",
+  "profile_name": "my-profile",
+  "browser_region": "eu-west"
+}
+```
+
+For the secure login panel, pass `region` to `open_auth_login`. See [Connection Configuration](/auth/configuration#browser-region) for SDK examples and update semantics.
+
 ## Create a regional browser pool
 
 Set `region` when creating a pool, or choose **Region** in the dashboard's pool creation dialog:

changelog.mdx

@@ -24,6 +24,7 @@ For API library updates, see the [Node SDK](https://github.com/onkernel/kernel-n
 - Documented [Vaults](/vaults) and [browser payments](/integrations/payments/overview), including checkout and payment-processor support, app-invocation billing, and Vault payment security guidance, and added them to the [pricing page](/info/pricing).
 - Added a new [Cookbooks](/cookbooks) tab with 13 end-to-end recipes — AI SDK, Browser Use, Claude computer use and managed agents, e2b, Eve x Foreman, Eve x Managed Auth, Mastra, Modal, Stagehand, Tinker, and Vibium — plus a Common Patterns section for the Playwright computer-use fallback and browser payments.
 - Added regional browsers to the [pricing page](/info/pricing).
+- Added regional placement to [Managed Auth](/auth/configuration#browser-region). Set a connection default or override one login through the SDK, dashboard, CLI, or MCP server; health checks and automatic reauthentication use the connection's region.
 - Added a canonical [network access allowlist](/info/network-access) reference for configuring egress.
 </Update>
 

reference/cli/managed-auth.mdx

@@ -19,6 +19,7 @@ Create a managed auth connection for a profile and domain.
 | `--health-check-interval <seconds>` | Seconds between health checks (300–86400). |
 | `--no-health-checks` | Disable periodic health checks. |
 | `--no-auto-reauth` | Disable automatic reauthentication attempts after an expired session is detected. |
+| `--region <region>` | Browser region for login, health-check, and reauthentication sessions: `us-east`, `eu-west`, or `ap-southeast`. Defaults to `us-east`. |
 | `--proxy-id <id>` | Proxy ID to use. |
 | `--proxy-name <name>` | Proxy name to use. |
 | `--credential-provider <name>` | External credential provider name. |
@@ -52,6 +53,7 @@ Start a login flow and return a hosted URL for authentication.
 
 | Flag | Description |
 |------|-------------|
+| `--region <region>` | Region override for this login only. Omit it to inherit the connection region. |
 | `--proxy-id <id>` | Proxy ID to use for this login. |
 | `--proxy-name <name>` | Proxy name to use for this login. |
 | `--telemetry <spec>` | Override telemetry for this login only, merged with the connection's config. Pass `all`, `off`, or a comma-separated category list like `console,network`. |
@@ -110,6 +112,7 @@ Update connection settings such as login URL, health checks, credential source,
 | `--health-check-interval <seconds>` | Seconds between health checks. |
 | `--health-checks` / `--no-health-checks` | Enable or disable periodic health checks. |
 | `--auto-reauth` / `--no-auto-reauth` | Enable or disable automatic reauthentication attempts after an expired session is detected. |
+| `--region <region>` | Region for browser sessions created after the update: `us-east`, `eu-west`, or `ap-southeast`. Active sessions don't move. |
 | `--proxy-id <id>` | Proxy ID to use. |
 | `--proxy-name <name>` | Proxy name to use. |
 | `--credential-provider <name>` | External credential provider name. |