Reliable, consistent runs, every time.
A Persona is a reusable identity Writ applies automatically: its own saved identity and network settings, a warm saved session, credentials, and 2FA. Your authenticated workflows just work, on the accounts you own.
One identity your runs reuse
A Persona holds everything a run needs to sign in as you and stay consistent on one site: a login, a Fernet-encrypted password, an optional 2FA method, a pinned browser fingerprint, a preferred region, and a warm authenticated session (cookies, localStorage, and headers) shared across every workflow that uses it.
Attach it to a workflow and Writ signs in as you and stays consistent from run to run: the same identity, the same place, the same warm session. Exactly the work a person would do by hand in a browser.
Authorized access, not circumvention. Writ runs on your own accounts, with your own credentials and data, on sites you are authorized to use.
acme-prod-login
What it bundles
Login
Identifier + encrypted password
2FA
TOTP seed or email OTP
Fingerprint
User agent, locale, timezone
Warm session
Cookies, storage, headers
Egress & region
Pinned agent + egress region
It clears 2FA the way you would
TOTP prompts and one-time email codes stop other tools cold. Writ completes them automatically, signing into your own account the way you already do.
TOTP authenticator
Store an encrypted base32 TOTP seed on the Persona. Writ generates the current 6-digit code server-side at login time (the same code your authenticator app would show), with configurable digits, period, and algorithm (SHA1 / SHA256 / SHA512). The seed is Fernet-encrypted and never returned by the API.
{
"method": "totp",
"algorithm": "SHA1",
"digits": 6,
"period": 30
} Email OTP & magic links
Connect a mailbox over OAuth, or point a forwarding relay address at the Persona. When a site emails a one-time code or a magic link, Writ reads it from your inbox using a parse rule you define (from-address filter, subject regex, code regex, link regex, max age), and completes the step. You read codes from accounts you own; Writ never touches anyone else's mailbox.
{
"method": "mailbox_otp",
"from": "[email protected]",
"code_regex": "\\b\\d{6}\\b",
"max_age_seconds": 120
} Skip the login on every run after the first
After the first successful login, Writ saves an encrypted auth session (cookies, localStorage, sessionStorage, headers, and fingerprint) on the Persona and reuses it across every workflow that references it. Subsequent runs skip the login flow entirely until the session expires: faster runs, fewer 2FA prompts, and less chance of a tripped login.
Writ tracks the earliest cookie expiry, expires_at, a validation status (valid / expired / unknown), last_login_at, and last_used_at so that it re-authenticates only when needed.
The same identity, the same place, every run
A Persona looks and connects the same way every time, so your account behaves predictably for sites that expect a stable identity and location.
Set it once, call it like an API
Create a Persona, attach it to a workflow, and call that workflow as a REST endpoint or MCP tool. It runs authenticated, on your account, with no login to babysit.
curl -X POST https://api.usewrit.app/v1/acme-portal/export \
-H "Authorization: Bearer wt_..." \
-d '{"persona":"acme-prod-login","range":"last_30d"}' Marketplace recipes use your own Persona. When you install a marketplace recipe, you attach your own Persona. The creator's credentials are stripped at publish and never used. How installing works →
Resolved in a fixed order, so rotations land instantly
When a workflow runs, Writ resolves a {{vault:key}} reference in a fixed order, and a rotation takes effect on the very next run.
Each external provider has its own priority and an enable switch, plus a test button that records the last result, so you can verify a connection before you rely on it.
Already have a secret manager? Point Writ at it
Standardized on a secret manager? Connect it and Writ resolves {{vault:key}} against it at run time, with no secrets copied into a second system. Connection details are Fernet-encrypted; set a priority per provider and test before you rely on it.
Per-provider config
Each connection stores a priority, an enabled flag, and the last test outcome (last_tested_at, last_test_success, last_test_error).
Your credentials stay sealed
Personas are tenant-isolated and cloud-only. Every secret field is Fernet-encrypted at rest and is never returned through the API, shown to the AI, or written to logs.
Frequently asked
Where do my credentials live?
Every secret field (password, TOTP seed, mailbox tokens, proxy credentials, and saved session state) is Fernet-encrypted at rest with the platform encryption key and is never returned through the API, shown to the AI, or written to logs.
Is using stored 2FA allowed?
A Persona only logs into your own authorized account. You supply your own TOTP seed or connect your own mailbox, and Writ completes the same 2FA step you would do by hand. It does not defeat anyone else's security.
What sites can I use Personas on?
Sites you own or are otherwise authorized to access. Writ runs on your own accounts, with your own credentials and data, on sites you are authorized to use. See the Acceptable Use Policy for details.
Local vs cloud?
Personas are a cloud feature, available on paid plans. Local and BYO agents handle their own authentication on your own machine.
Reliable, consistent runs, every time.
Create a Persona, attach it to a workflow, and call it like any API, on your own authorized accounts.