Can I read a stored password back out?

No, and that is not an oversight. The vault is write-only from the API’s point of view: you can store a secret and reference it by name, and the value is decrypted only inside the browser at the moment it is typed. There is no endpoint that returns it.

Sessions & HITL

Which logins you hold, masked

The stored logins as { label, host, emailPreview } — the label is what you pass as `account` on a run, and the credential itself never leaves the vault.

Get an API key MCP setup

list_accounts

What it is

The job: Answer “can I get into this site, and as whom?” before starting a run.

Every run-shaped endpoint takes an `account` label to choose between several logins for a host. list_accounts is what tells you which labels exist. It returns metadata only — the label, the host it is bound to, a masked email preview and whether a password is stored — and the ciphertext is never loaded to answer it.

That is the whole design of the credential system in one call: an agent picks an identity by name, the platform resolves the secret inside the browser at fill time, and the credential leaves the vault exactly once, into a form field, never into a prompt or a response.

Nothing back for a host? You have no way in yet. connect_account is the next call.

The call

Call it exactly like this.

Copied from the tool's registration and the route handler — not paraphrased.

MCPlist_accounts.mcp.jsonjson

// MCP tool call — server "twin-browser"
{
  "tool": "list_accounts",
  "arguments": {
    "host": "example.com"
  }
}

GET /api/v1/accountsrequest.shbash

curl -X GET "https://twin-browser.com/api/v1/accounts?host=example.com" \
  -H "Authorization: Bearer $TWIN_API_KEY"

Parameters accepted by list_accounts
Parameter	Type	What it does
host	string	Narrow to logins usable on one site, e.g. "example.com". Accounts with no host bound are always included.
url	string	The same, as a full URL — the hostname is derived from it.

Returns

response.jsonjson

{
  "accounts": [
    { "label": "work", "host": "example.com", "emailPreview": "a•••@example.com",
      "hasPassword": true, "createdAt": "…" }
  ],
  "count": 1
}

What it costs

Free

Read-only masked metadata. No credits, and no decryption — the vault is not opened to answer this.

See the full rate card

Which one

When a different tool is the right call.

The honest answer is often the neighbouring tool. These are the trades.

list_catalog

Catalog answers the same question per skill, with a ready/missing verdict attached. Use accounts when you are choosing an identity; use catalog when you are choosing a skill.

list_catalog

connect_account

The natural follow-on when the answer here is empty.

connect_account

Questions

list_accounts, answered.

Can I read a stored password back out?: No, and that is not an oversight. The vault is write-only from the API’s point of view: you can store a secret and reference it by name, and the value is decrypted only inside the browser at the moment it is typed. There is no endpoint that returns it.

Keep going

The rest of the tool set.

connect_account

Get logged into a site that an agent is not going to be allowed to log into.

list_connections

Stop an agent from re-running a task before the user has actually signed in.

list_catalog

Let an agent plan: pick a skill it can actually run, with values it can actually supply.

run_goal

Do one thing on one site, right now, and block until you know whether it worked.

The mechanism behind it:Credential vault

Get an API key All tools