Browser Identity | AGI Cockpit Documentation

A Browser Identity is a local persistent area that separates sign-in state and site data for the in-app browser. Use different Identities for different jobs, clients, or verification conditions when the same site needs separate accounts.

It is separate from an agent account profile. Browser Identity isolates website state; an agent profile isolates execution authentication for Claude, Codex, or another task agent.

Data isolated by an Identity

Each Identity separates:

Cookies and cache
localStorage and site permissions
Proxy authentication
Browser sessions and navigation history
Identity-scoped passkey and WebAuthn state

Popups and OAuth windows inherit their parent tab's Identity. Switching to another Identity never copies this data.

Default Identity

Tasks and Autoruns without an explicit assignment use Default Identity. Default preserves the legacy persist:in-app-browser area and its existing sign-ins.

Default Identity can be identified by name and color but cannot be removed. To verify a public signed-out result, create a separate empty Identity instead of clearing Default's cookies.

cockpit browser identity create --name logged-out-check
cockpit task browser-identity logged-out-check
cockpit browser open https://example.com --browser-identity logged-out-check --json

Create and inspect Identities

Open Browser from the lower-left app menu. Choose Add Identity in the left sidebar to create one, or select an Identity to edit its name and color above its tab list. Choose Save to apply edits. Data clearing and deletion require confirmation; Default cannot be deleted. The equivalent CLI commands are:

cockpit browser identity list --in-use --json
cockpit browser identity get work --json
cockpit browser identity usages work --json
cockpit browser identity create --name work --color "#3B82F6" --json
cockpit browser identity update work --name client-a --color "#8B5CF6" --json

list reports usage counts and filters all, in-use, or unused Identities. get and usages return Identity metadata, counts, and the tasks, Autoruns, and browser sessions that reference it.

Assign an Identity to a task

A task can use several Browser Identities, with one primary Identity used when a command does not specify one. Each session and its tabs belong to exactly one Identity. Select an initial Identity when creating a task, then manage assignments from the browser side panel or CLI.

cockpit task browser-identity <taskId> --add work
cockpit task browser-identity <taskId> --primary work
cockpit task browser-identity <taskId> --primary default
cockpit task browser-identity <taskId> --remove work
cockpit task browser-identity <taskId>

Inside a task, omit the task ID to manage the calling task. A bare Identity argument replaces the whole assignment with that single Identity. Before removing the primary Identity, make another assigned Identity primary. Removing an assignment preserves its sessions, tabs, cookies, and saved data; agent access resumes when the Identity is assigned again. Other tasks are unaffected.

cockpit browser open ... --browser-identity work selects an assigned Identity without changing assignments or navigating another Identity's tabs. Unassigned Identities are rejected. An explicit session or tab that disagrees with --browser-identity fails with browser_identity_mismatch; a tab outside an explicit --session fails with browser_session_mismatch. Commands resolve their target once, so later primary-Identity or side-panel changes do not redirect an operation already running.

Assign Identities to Autorun and Fleet

A new-task Autorun stores its Browser Identity assignment and passes it to every task it creates. An Autorun without an assignment uses Default. An existing-task Autorun does not change the target task's Identity.

Fleet can assign a Browser Identity to each task node. Give nodes explicit, purpose-specific Identities when they require different signed-in states instead of sharing one Identity.

Import a browser session on macOS

On macOS, finish sign-in in Chrome, Brave, Edge, Arc, Vivaldi, Opera, or Firefox, then import the supported state for the selected in-app tab into its Browser Identity. Inspect detected browsers and profiles first when you need an exact source.

cockpit browser import-sources --json
cockpit browser import-session --browser-identity work --browser brave --profile-id "Profile 2" --json

--browser-identity selects the AGI Cockpit destination. --browser selects the source browser, while --profile-id selects the discovered profile unambiguously; --profile can instead match a profile directory or Firefox profile name. With no source option, Cockpit chooses the most recently used preferred profile across the detected browsers.

Chromium sources import cookies for the tab's registrable domain and localStorage for its exact origin. Each browser has a separate Safe Storage Keychain item, so its first applicable import may show a macOS permission prompt. Firefox imports cookies only and does not access Keychain; the result reports that localStorage was unsupported.

The import does not transfer sessionStorage, IndexedDB, extension state, device-bound authentication, or the passkey itself. If the site remains signed out, sign in once inside that Identity's in-app browser. import-cookies is retained for compatibility but moves cookies only, so prefer import-session. Import is supported only on macOS.

An import copies the session already present in the source browser; it does not sign in to another account. Check the source account first. Signing out in the source browser afterward may invalidate Cockpit's copied session when the site revokes that session server-side.

Clear data or remove an Identity

Clear and remove cannot be undone, and both require --confirm.

cockpit browser identity clear client-a --cookies --confirm --json
cockpit browser identity clear client-a --all --confirm --json
cockpit browser identity remove client-a --replace-with default --confirm --json

clear closes the Identity's live sessions before clearing exactly one of all data, cookies, or cache. remove clears every persistent data type and deletes the Identity itself.

An Identity referenced by an active task or Autorun cannot be removed without --replace-with. Cockpit reassigns those references first and rolls them back if removal fails. In tasks with several Identities, only the removed Identity is replaced; its replacement becomes primary if needed. Without a replacement, completed tasks drop the removed assignment and fall back to Default if their primary Identity was removed.

Use usages to inspect affected tasks, Autoruns, and sessions before removal.