My app uses Google/Microsoft sign-in (SSO). Is that supported?

SSO and MFA cannot be automated. Use a test account with email + password, or copy a session token/cookie into the Header or Cookie type.

My check page always returns 200. Why is the login considered failed?

Many SPAs return 200 for any address. If the check page also opens without login, the login cannot be proven. Choose an API endpoint that returns 401 without a token, or enter a marker text that only appears after login.

Authenticated scanning: testing pages behind login

How to set up authenticated scans in Phylex Scan: header token, session cookie, login form, or Firebase, plus the login check URL and API endpoints.

Most vulnerabilities live behind the login: dashboards, account settings, and APIs. Authenticated scanning (Pro plan and up) lets Phylex sign in as a test account and check that area.

Before you start: prepare a test account

Create an account just for testing, not an admin account or a real customer's account.
Turn off two-factor authentication (MFA) and CAPTCHA for this account, or use the Header/Cookie types.
With the Standard profile and login, the scan can change or delete the test account's data. Do it on staging.

Choose a login type

In the Assets tab, open the asset card (click the hostname), click Set up login in the Authenticated scan card, then choose:

Login form (username + password): for classic web apps (PHP, Laravel, Django, WordPress, Rails). Enter the login page (for example /login), username, and password. Phylex fills in that form on every scan, including the CSRF token, and uses the resulting session cookie. Fields are detected automatically; enter field names only if detection fails. Forms rendered by JavaScript are not supported.
Firebase (email + password): for apps using Firebase Authentication. Enter the Firebase web API key (apiKey in the app config, not a server key), plus the test account's email and password. Enter the web app address if the API key is restricted by site. Tokens refresh automatically during the scan.
Header (token / API key): for APIs. Example: Authorization = Bearer eyJ…, or X-API-Key. Expired tokens must be updated by hand.
Session cookie: copy the cookie from your browser after logging in (format name=value; name2=value2). Good for a quick test; cookies usually expire fast.

Login check URL

Enter a page that opens only when logged in (for example /account/profile, or an API endpoint that returns 401 without a token), and optionally a marker text that only appears when logged in (for example "Log out"). Before the scan, Phylex opens that page with and without the login. If the login cannot be proven, the scan still runs without login, the report is labeled, and you get an email.

Excluded paths and seed URLs

Excluded paths: pages the scan must not touch, such as /admin/delete or /billing. Logout paths and the login page are always excluded automatically.
Seed URLs / API endpoints: addresses (GET) opened right after login. Required for APIs, because API endpoints are not linked from any page. You can import them from an OpenAPI/Swagger file (.json/.yaml); server addresses in the file are ignored and the scan always targets the asset host.

How credentials are protected

Credentials are encrypted with Cloud KMS and never shown again after saving.
Only the scanner can decrypt them, and they are only sent to that asset's host (Firebase passwords only to Google). Forms or redirects to other hosts are refused.
Credential values are redacted from all logs and scan results.
Delete credentials anytime with Delete credentials; they are removed automatically when the asset is deleted.

Used for scheduled scans

Tick "Also use for scheduled scans" so recurring scans log in too. If the login check fails twice in a row, scheduled scans run without login until the credentials are updated.