[akxue]

context

managed auth connections have a hitl setting. when it's on and a login hits a CAPTCHA the login browser can't get past, the login pauses at AWAITING_HUMAN_INTERVENTION so a person can complete the check in the live view, then resumes from the page they left. without it the login fails with captcha_blocked. the API reference already covers the new field, step and choice type, since it's generated from the spec. the guides didn't mention any of it.

changes

• configuration: a "human verification for CAPTCHAs" section with create examples in TS, Python and Go. it says when the pause applies (any .login(), including a pre-task check and CAPTCHAs in front of the login form; never reauth after a health check), the 10 minute wait per pause, the timeout error, and the note on repeat pauses. adds hitl to the update table.
• programmatic: the main stream-and-submit loop handles AWAITING_HUMAN_INTERVENTION: it shows the live view without blocking, so a timed-out pause still reaches the loop, and closes it when the flow moves on. a human verification section covers the submit, the 400 for anything else at this step, repeat pauses, falling back to the connection's live_view_url when the event doesn't carry one, keeping the live view to the person signing in, and the wildcard frame-src values (linked to the CSP section rather than a single host, since live view hostnames change between sessions). adds the step and choice type to the reference lists.
• connection lifecycle: the pre-task auth check also stops on AWAITING_HUMAN_INTERVENTION and sends the user to hosted_url, with a note on what the pause means for unattended jobs. the captcha_blocked row and recovery advice mention hitl.
• react: a section on the embedded live view, the captcha_blocked onError on timeout, the frame-src values and the 0.6.0 minimum. the intro notes the live view is served from a KERNEL domain. HumanInterventionStep is added to the exported components.
• hosted UI: one line for the CAPTCHA step, noting it runs on KERNEL's page so your CSP isn't involved.

testing

• checked behavior and wording against the API spec, the workflow code, the @onkernel/managed-auth-react 0.6.0 source, and the SDK types.
• the new snippets type-check against the 0.144.0 SDKs: TS with tsc --strict, Python with mypy --strict, Go with go vet.
• mint broken-links passes, the five pages load in mint dev with no MDX errors, and the new anchors resolve.
• not tested: a live login that pauses on a real CAPTCHA, and the rendered pages weren't checked visually.
• no changelog entry in this PR.

---

Note

Low Risk
Documentation-only updates with no runtime or API implementation changes in this PR.

Overview
This PR documents managed auth human-in-the-loop CAPTCHA handling via the connection hitl flag and the AWAITING_HUMAN_INTERVENTION flow step across the auth guides.

Configuration adds a dedicated section on enabling hitl, when pauses apply (interactive .login() only, not unattended reauth), the ~10-minute timeout → captcha_blocked, and repeat CAPTCHA pauses; hitl is also listed in the connection update table.

Programmatic, lifecycle, Hosted UI, and React pages are updated so integrators know to stop or branch on AWAITING_HUMAN_INTERVENTION, show the login browser live view, submit the human_intervention choice, handle missing live_view_url, and relax CSP frame-src for KERNEL live-view domains; the React guide notes HumanInterventionStep, onError on timeout, and package 0.6.0+.

^{Reviewed by Cursor Bugbot for commit 4c0412a. Bugbot is set up for automated code reviews on this repo. Configure here.}

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
Kernel	🟢 Ready	View Preview	Nov 13, 2026, 1:01 AM

💡 Tip: Enable Automations to automatically generate PRs for you.

[akxue]

Picked AnnaXWang to review: touched the changed code in auth, lighter queue than masnwilliams; nothing pending