A signed-in page.
A clear way to watch it.

Start with a cookie-based, read-only page.

A connection is one exact HTTPS origin, such as https://portal.example.com, and a Cookie header that lets the source site recognize a session. Sign in yourself, including any MFA. PageFluxer then reuses that supplied header until it expires or you revoke it. It never inherits your normal browser session, stores your password, submits a login form or solves a challenge.

• Browser checks only, for webpage text, prices, availability, listings or visual comparisons. Normal Browser quotas and capture limits apply.
• Every request stays on the approved origin. Subdomains are different origins. Third-party scripts, styles, images and APIs are blocked. A page that depends on them may be incomplete or unsupported; a visual capture fails if required external image, font or style resources are blocked.
• GET requests only. POST-based data APIs, login replay, local/session storage tokens, indexed databases, HTTP Basic auth, client certificates, cross-origin frames, WebSockets, VPN/private-network pages and CAPTCHA are unsupported. GET-only enforcement is not a guarantee that a poorly designed source site has no side effects.
• Cookies are sent as a header by the capture gateway, not inserted into JavaScript or a persistent browser profile. Pages that need to read a session cookie in JavaScript, rotate it through Set-Cookie on each request, or bind it to your device/IP/browser may not work.
• Direct PDF, RSS, Atom and sitemap sources remain public-only. No automatic authenticated discovery or background login refresh.

Use a dedicated read-only account with minimal permissions. Do not connect a personal admin, banking or payment account. A successful preview verifies this capture, not permanent access or universal site compatibility.

Connect a site once.

1. As a workspace owner or admin, open Site connections. Confirm that everyone in this workspace is allowed to see the source account’s content.
2. In your own browser, sign in to the source website. Complete its normal MFA or other checks yourself. Open the exact page you want to monitor.
3. In Chrome DevTools, open Network, refresh the page, select its main document request, and look under Request Headers → Cookie. Copy only the header’s value: session=value; another_cookie=value. Do not copy a whole cURL command, HAR export, Authorization header, response Set-Cookie attributes, or cookies from other sites. Cookies are credentials: paste them only into PageFluxer’s protected Cookie field, never into chat, an AI prompt, a support ticket, a URL or recorded steps.
4. Enter the exact HTTPS origin and a descriptive connection name. Paste the Cookie value. The form clears this secret after submission and does not display it again.
5. Choose a signed-in CSS selector and its expected visible text. Use a unique account-navigation element that appears only while signed in, for example #account-navigation containing Sign out. In DevTools, inspect that element and copy a simple CSS selector. The expected text is case-sensitive with page whitespace normalized. Avoid a generic body/header marker that also exists on the login screen.
6. Choose a maximum lifetime of 1, 7, 14 or 30 days and confirm your authority to share this session with the workspace. Save. The source site can expire it sooner.

Saving stores the session; it does not claim that the site works. The cloud preview in the next step verifies access before you can save a monitor. A guard must identify exactly one visible element within five seconds, before steps and again before capture.

Keep your usual monitor flow.

1. Enter the page URL in Create a monitor and open Page requires sign-in?.
2. Select the saved site connection. Browser loading is used. If you connected it in another tab, click Refresh list.
3. Load the cloud preview, choose your goal and whole page or target elements, and check that the correct account’s content is visible. Visual monitoring uses the same connection selector.
4. Optionally add non-sensitive filters or clicks under Page loading & steps. The access marker must work both before and after those steps. Never add a password or session token to a recipe.
5. Save the baseline. Your existing conditions and notification controls apply. The initial baseline is quiet.

If the session is rejected or the signed-in marker fails, PageFluxer stops using that session and asks for reconnection. A login page never replaces the accepted baseline. Other failures, such as a timeout, retain the session and follow normal retries. Guard selection is your responsibility: a marker that also appears when logged out cannot reliably prove sign-in.

The Chrome extension continues to send selections and recorded steps. It does not transfer a session; choose the separately approved connection in PageFluxer. A monitor copy keeps its connection reference, and the new URL must match that connection’s origin and pass a new preview.

Expiration is a state, not a content change.

When PageFluxer’s lifetime ends or a signed-in check fails, checks stop and stored session material is deleted from active records by the failure/expiry workflow. The previous baseline and retained history remain. Monitor-health emails can tell you about expired or rejected access, using the existing deduplication and notification settings. No-change alerts cannot treat interrupted checks as proof that nothing changed.

Sign in to the source again, choose Replace session, and provide a fresh Cookie value. Replacing a session increments its version and invalidates old previews and in-flight capture results. Open Edit monitoring for each linked monitor, verify the new account content and save a fresh, quiet baseline. This prevents an account switch from becoming a misleading change alert. Manually paused monitors remain paused.

Revoke deletes PageFluxer’s stored secret and stops new authenticated captures. It does not log out your browser or revoke that session at the source site. Revoke it there too when appropriate. A capture already dispatched can finish, but its obsolete result is not accepted. Existing history, delivered messages and previously issued image links have their normal retention/access rules. Remove an unused revoked connection after detaching it from its monitors.

Workspace access includes connected content.

Owners and admins can add, replace or revoke sessions. Members can use approved connections and view captured content, but cannot retrieve the stored Cookie value. Approval grants the workspace access to pages on that origin as that source account; it is not a per-monitor permission boundary. Review members, API tokens and assistant connections before adding sensitive sources.

Sessions use authenticated encryption in the application database, with separate server-side keys and context binding to the workspace, connection and origin. The renderer receives the individual session only for a bounded job; it receives no database or encryption keys. Fresh browser contexts are destroyed after each job. Names, origin, guard and expiration metadata are visible in the workspace. Connection activity is recorded in the existing workspace audit log without Cookie values.

Text captures use normal Postgres history/storage limits. Visual captures use existing private object storage and lifecycle deletion. Expiration or revocation removes active session material, not previously captured content, backups or delivered messages. Delete monitors to remove their captured history. Backups and provider records have separate retention. See Security & data handling.

PageFluxer’s AI setup and AI change summaries are unavailable for authenticated captures. Regular conditions and notifications still work. Enabled email, webhook, Slack and Teams destinations can receive captured excerpts. API clients and connected MCP assistants with suitable scopes can read private captures; those recipients have their own data-handling policies.

Included on paid plans.

Starter includes one connection to prove the workflow. Pro has five; Business has twenty shared by the workspace. One connection can serve multiple monitors on its origin; each monitor still uses a monitor slot and its own scheduled Browser checks. The Free Browser trial covers public pages only. Expired sessions retain a slot until reconnected or revoked. After downgrade, the oldest non-revoked connections within the new allowance can run; excess connections require revocation or an upgrade. Moving to Free expires active sessions. No separate session fee or unlimited checks.

Use references, never secrets, in integrations.

Manage secrets in Site connections. Its API / assistant reference is a non-secret UUID. Pro/Business REST previews and MCP preview_monitor accept an optional site_connection_id. Use Browser loading. Create the monitor from that preview with the same reference; changes or detachment require a fresh preview and the monitor’s current version. Explicit null detaches when saving a public preview. Omitting the field cannot silently remove an existing connection.

Monitor responses expose the connection reference and whether a new baseline is needed. Session values, encryption keys, and login controls have no public API or MCP tool. Existing workspace/token scopes apply. Do not paste credentials into an assistant conversation.

{
  "url": "https://portal.example.com/notices",
  "load_mode": "browser",
  "site_connection_id": "your-approved-connection-uuid"
}