Test accounts
A test account is a user an agent or a CI job can sign in as, to test a product end to end. It belongs to one environment of one Product, and the credentials behind it are kept by Helm7 and never given to the model.
This page covers what an account is, who can read what, and where to find each operation. The exact arguments are in the API and CLI references, which are generated from the same definitions.
01
Create or register
Provision a fresh user, or register one you already have.
02
Check out
The tester leases the credentials for one run.
03
Use
Sign in, fetch a 2FA code if asked, run the test.
04
Expire or delete
It goes on its schedule, or when you say.
Two ways to get one
Provisioned
Helm7 creates the user in the product's own auth, with a generated password, and tags it as a test user. Give it an expiry, from five minutes to ninety days, and Helm7 disables the account, wipes its secrets and removes the user, within about five minutes of the time passing. Managed auth has to be enabled first.
It takes one call from an agent or the API, or one click in the Product's dashboard.
Registered
If an account already exists, or the product is hosted outside Helm7, register it with its email, its password and, if it has one, its two-factor seed. It is then managed like any other.
Deleting a registered account removes it from Helm7 only. The user stays in your product, because Helm7 did not make it.
Who can read what
Passwords and 2FA seeds are encrypted when stored. List and inspect show a fingerprint and whether a seed exists, never the values, and no call returns them except checkout and totp.
The agent
Over MCP it can create, list, inspect, rotate and delete accounts. With a key that holds test_account:use it can also check one out and ask for a 2FA code. The seed never leaves Helm7.
A CI step or your own code
Anything with the separate test_account:use scope can do the same over REST, the CLI or the SDK. Checkout gives it the email, the password, the current 2FA code and, for a provisioned account, a real session. It names the run it is for, and that is logged.
- Leases. A checkout lasts 15 minutes by default, and you can ask for between one minute and an hour. When it ends, the sessions Helm7 minted for it are revoked.
- Two-factor codes. test_account_totp returns the current six digits and how long they last. Ask again for a fresh one. The seed never leaves Helm7.
- Audit. Each checkout is written to the activity log with the run that asked. Codes are not logged one by one, because a flow may ask every few seconds.
Every surface
Test accounts are catalogue operations, so each surface below does the same things. The dashboard has a test accounts panel on every Product.
Giving an agent access
Add the account on the Product's Test accounts panel, then press Give an agent access. It opens a new key with the Test a product preset and that Product already chosen: it can see the Product and sign in as its test accounts, and change nothing. Set a short expiry, mint it, and give the key to the agent.
Operations
- test_account_create
- Create a test account. test_account:write
- test_account_list
- List test accounts. test_account:read
- test_account_get
- Inspect a test account. test_account:read
- test_account_rotate
- Rotate a test account password. test_account:write
- test_account_delete
- Delete a test account. test_account:write
- test_account_checkout
- Check out a test account to sign in with. test_account:use
- test_account_totp
- Get the current two-factor code. test_account:use
CLI
Flags for each command are in the CLI reference. The same operations are in the REST API reference and the SDK, and in /llms.txt for a model.
Rules worth knowing
- An account belongs to one environment, and its label is unique within it.
- Test accounts must never pay for anything real. A flow that reaches a live paywall should stop there.
- Rotating a provisioned account also signs out every session it has. A registered account needs the new password you have set in the product.
- Deleting needs confirm: true, and only a user tagged as a test user can be removed this way.
For the overview and the reasoning, see test accounts. For keys and limits in general, see agents.