Automate a login with 2FA
Run a complete login journey that needs an approval in LuxTrust Mobile, itsme, Microsoft Authenticator or another Android 2FA app.
How it works
How Q-Bot gets past the 2FA step
From banking login flows to nightly CI regressions, here is how QA teams automate two-factor authentication with Q-Bot.
Use cases
When to use it
Four situations where the test pipeline gets unblocked, with nobody approving by hand.
Run suites with no human intervention
Launch your regression runs, at night or from your CI/CD, without a tester having to approve two-factor authentication by hand.
Retrieve a one-time code
Q-Bot can open the 2FA app and retrieve the code your test needs to carry on.
Automate QR-code journeys
Q-Bot can show a QR code on its built-in display so the smartphone can scan it as part of the automated scenario.
The principle
How it works
Your test pipeline stays in charge from end to end. Q-Bot only takes over the two-factor authentication step, then hands control back.
1
The test reaches the 2FA step
The automated journey hits the step that needs an approval on a smartphone. This is where test tools stop.
2
Q-Bot is triggered
Your test calls the API, or the companion app detects the notification that just landed on the phone.
3
The scenario runs on the smartphone
Q-Bot replays the saved taps and wait times in the genuine 2FA app, over USB.
4
The authentication is completed
The request is approved on the phone, or the one-time code is retrieved and handed back to your test.
5
The test carries on
The journey resumes where it stopped, with nobody in front of the screen, day or night.
Triggering
Two ways to trigger it
One call from your pipeline, or none at all: the companion app fires the moment a 2FA notification reaches the device.
From your test pipeline
A single HTTP request when the test reaches the 2FA step. Explicit, deterministic, easy to integrate into any pipeline.
GET /scenarios/:id/execute- No API key, no agent to install
From the device
The Q-Bot companion app runs right on the device under test and watches for 2FA notifications. The moment one is detected, it triggers the matching scenario automatically.
- No call from your test runner needed
- Runs on the same device Q-Bot already controls, nothing extra to pair or manage
- Ideal when 2FA timing is unpredictable or controlled by the app under test
Both paths can coexist in the same environment: use whichever fits each scenario. Either way, taps reach the phone over ADB, Android's standard tool for driving a device connected by USB. The loop alongside shows the gesture: the notification arrives, the scenario plays, the phone screen changes.
Ready to eliminate your last manual step?
Going further
Call examples, tool by tool
The detail for whoever wants it: five call examples, expandable, and the mechanism tool by tool.
# Trigger the 2FA scenario
import requests
requests.get(
"http://q-bot.local:8000"
"/scenarios/42/execute"
)
# The test carries on
driver.find_element(
By.ID, "dashboard"
).is_displayed()// Trigger the 2FA scenario
cy.request(
'GET',
'http://q-bot.local:8000'
+ '/scenarios/42/execute'
)
.its('status')
.should('eq', 200)
cy.get('#dashboard')
.should('be.visible')# Trigger the 2FA scenario
curl -s \
http://q-bot.local:8000 \
/scenarios/42/execute
# LuxTrust OTP
OTP=$(curl -s \
http://q-bot.local:8000 \
/get-luxtrust-otp \
| jq -r '.otp')*** Settings ***
Library RequestsLibrary
*** Test Cases ***
2FA Login
# trigger the scenario
${r}= GET
... ${QBOT}/scenarios/42/execute
Status Should Be 200 ${r}// trigger the 2FA scenario
given()
.baseUri("http://q-bot.local:8000")
.when()
.get("/scenarios/42/execute")
.then()
.statusCode(200);
// the test carries on
assertTrue(
dashboard.isDisplayed()
);Q-Bot is self-hosted: the API answers on the network where you install the device, for as long as it is powered on, with no external dependency. It expects no API key: access control is your network's.