Credentials

Returns summaries: label, site, username, and whether a password and a two-factor secret exist — never the values. encryptionAvailable reports whether this machine has a usable keychain; when it is false, secrets are stored as plain text and each record says so in its own encrypted field. Logins are held per profile rather than in one shared vault, because a shared vault makes it possible to fill the wrong account into the wrong session.

Encrypts the password and any two-factor secret before writing them. totpSecret is accepted as base32 in any spacing or case, or as a whole otpauth:// URI copied from behind a QR code — all three are the same secret and all three work, so a user cannot silently save a broken credential and find out at the login screen.

Only the fields you send change. Omitting password leaves the stored one alone — that is the point of a patch here, because the editor shows a placeholder rather than the real value and an untouched form must not wipe the password with the empty string it appears to contain. Sending totpSecret as an empty string removes two-factor from the login.

Removes it immediately. Credentials do not go to the trash — a password you asked to delete should be gone.

What Chromium itself saved while somebody used this profile, which is a different set from /credentials — that one is what Mosaic holds for the profile and fills on demand. Passwords are decrypted with the profile’s own key; a row that could not be decrypted comes back with password: null, which is not the same as an empty password and is never silently turned into one.

passwordManagerOff says the profile has Chromium’s password manager disabled, so an empty list there is a setting rather than a fact about the browser.

Writes a row Chromium will offer to fill, as though the browser had saved it. The profile has to be stopped: Chromium keeps its password store in memory while it runs and rewrites the file on exit, so a login added underneath a live browser is discarded without a word when that browser closes — which is why this refuses rather than returning a 200 that did nothing.

Scoped by realm and username, both required. An absent scope is a 400 and never "every login this browser has": on an irreversible route silence is refused rather than read as consent. Needs the profile stopped, for the same reason adding one does.

Chromium’s bookmark tree, flattened, with the folder each one sits in. This is what the profile has accumulated by being used — distinct from the bookmarks field on the profile, which is what Mosaic writes into the bar before every launch. A profile that has never run has no bookmarks file and answers with an empty list rather than an error.

Domains and visit counts, most visited first — not individual URLs. It is what the editor offers as suggestions when saving a login, and it is enough to answer "has this profile actually been used" without reading somebody’s browsing.

Returns the current RFC 6238 code and how long it stays valid. Check expiresIn before using it: a code with a second left will be rejected between generating it and submitting the form, which is the usual reason a working authenticator looks broken.

With ?reveal=1 the reply also carries the setup key itself and an otpauth:// URI for it. That is deliberate: a two-factor secret you cannot read back is one you cannot move to a phone or to another tool, and a profile is meant to carry everything an identity needs. The key is left out of the plain reply because the companion polls this route once a second while its panel is open, and a secret has no business in that traffic.

Types one field into whatever is focused in the running browser, as real keystrokes with human timing — not insertText and not by setting .value, because a field that goes from empty to twenty characters in one event fires no keydown and a login form that receives no keystrokes is a cheap bot signal. Focus the field in the browser first: this deliberately does not guess which input is the password box, since guessing wrong types a password into a search field. Asking for totp when the current code is nearly expired waits for the next one rather than filling a dead code.