Every automation that logs into something eventually hits the same wall: log in once, and either the automation re-runs that login flow—MFA and all—on every single execution, or it needs somewhere to keep the cookies, local storage, and cache that prove the browser is already authenticated. Get the second part wrong and session state ends up sitting in a file share, a CI artifact, or a database column with none of the handling a credential actually deserves.
What a Cookie Is Actually Standing In For
A session cookie is the server's way of remembering that a particular browser already proved who it is. Along with local storage tokens and cached assets, it's what separates a browser that looks freshly installed from one that's been used by the same account for weeks. That distinction does two jobs at once: it skips re-authentication, and it's part of what a site's risk scoring looks at when deciding whether a request looks legitimate. A completely empty cookie jar attempting a sensitive action is its own kind of anomaly.
Persisting State Without Rebuilding It Every Run
Anchor handles this with a Profile—an object that stores a browser's cookies, local storage, and cache and can be reattached to a later session. The pattern is a one-time save, then reuse by name:
// First run: log in once, save the profile
const session = await anchorClient.sessions.create({
browser: {
profile: { name: 'acme-portal', persist: true },
},
});
// ... complete the login flow inside this session, then end it.
// Ending the session is what writes the profile.
// Every later run: reuse it, no persist flag needed
const session = await anchorClient.sessions.create({
browser: {
profile: { name: 'acme-portal' },
},
});
// This session starts already signed in.Nothing about this stores the account's actual credentials. A profile is a snapshot of browser state, not a password vault, which is exactly why it doesn't try to re-authenticate on your behalf—if the target site invalidates the session server-side (password rotation, an expired token, a forced logout), the next run against that profile simply fails closed instead of quietly logging in with something it never had.
Where Persistence Becomes a Security Question
Once cookies are the thing standing in for a login, a saved profile deserves the same handling as any other credential. A few defaults are worth setting deliberately rather than by accident:
Scope profiles narrowly. A profile tied to one account for one target application is easy to reason about; a shared profile reused across unrelated automations is a single point of failure if any one of them leaks it. Treat a profile name the way you'd treat an API key name—specific, attributable, and not something pasted into a shared script.
Don't let profile state and code state mix. Cookies belong in whatever secret store your credentials already live in, not committed alongside the automation script that references them.
Pair identity with network consistency. A profile that suddenly connects from a different network than it did last week is a mismatch some sites will treat as suspicious on its own, independent of whether the cookie is still valid. Anchor's profile API supports a dedicated_sticky_ip flag when saving a profile from an existing session, so a given identity keeps a consistent network origin across runs—as much a reliability fix as a security one.
Expire what you're not using. A profile with no active use case is still a live session waiting to be reattached. Delete profiles you've stopped needing rather than letting them accumulate.
None of this is exotic—it's the same hygiene you'd apply to any other stored secret. The only thing that changes with browser automation is the shape of the secret: instead of a token in an environment variable, it's a cookie jar sitting inside a profile.
If you're building automations that need to stay logged in across runs without gluing credential storage together yourself, that's what Anchor's profiles are built for. Get an API key and try saving a profile against a login flow you're already automating.
