🎯 What You Will Learn
Reuse cookies and local storage with CLI state files without leaking authentication secrets into source control.
- Save authenticated cookies and local storage
- Load a state file into a later browser session
- Keep reusable login state out of Git
- Recognize expiration and server-side session limits
Understand Storage State
Storage state contains browser authentication material such as cookies and local storage. Loading it can make a fresh browser appear signed in without replaying the login form.
Treat it like a password: Anyone who receives a valid state file may be able to impersonate the test user until the server invalidates the session.
Create a Protected Auth Folder
Use a dedicated location and ignore it before saving any browser state.
playwright/.auth/
output/playwright/auth/Sign In with a Test Account
Open the application, snapshot the login form, and use current refs. Keep credentials in environment-backed tooling rather than embedding them in a committed shell script.
"$PWCLI" -s=login open https://example.com/login --headed
"$PWCLI" -s=login snapshot
"$PWCLI" -s=login fill eEMAIL "[email protected]"
"$PWCLI" -s=login fill ePASSWORD "use-a-secret-provider"
"$PWCLI" -s=login click eSIGN_IN
"$PWCLI" -s=login snapshotVerify Authentication Before Saving
Wait for the final signed-in page and confirm a user-visible account control. Saving too early can capture cookies before the login redirect finishes.
"$PWCLI" -s=login find "Account"
"$PWCLI" -s=login snapshotSave the Browser State
Write the state file only after successful verification and keep the path inside an ignored directory.
mkdir -p output/playwright/auth
"$PWCLI" -s=login state-save output/playwright/auth/user.jsonRestore State in a New Session
Create a separate session, load the state, then navigate to the protected page and verify the identity.
"$PWCLI" -s=restored open https://example.com --headed
"$PWCLI" -s=restored state-load output/playwright/auth/user.json
"$PWCLI" -s=restored goto https://example.com/account
"$PWCLI" -s=restored snapshotHandle Expiration and Revocation
A state file cannot bypass server rules. Expired cookies, revoked sessions, password changes, or multi-factor policy changes require a fresh authorized login.
- Detect the returned login page or missing account control.
- Delete the stale local state file.
- Run the login flow again.
- Save and verify the replacement state.
Clean Up and Rotate Test Sessions
Close browser sessions, revoke old server sessions when available, and rotate test credentials according to your team's policy.
"$PWCLI" -s=login close
"$PWCLI" -s=restored close
# Remove expired ignored state through your normal secure cleanup process.CI strategy: For committed Playwright Test suites, use a setup project and short-lived test accounts instead of sharing a developer's local state file.
Recap
- Storage state can contain reusable authentication material.
- Ignore state files before creating them.
- Verify the final signed-in state before saving.
- Expired or revoked server sessions must be recreated.
Checkpoint: You have completed the workflow and have a repeatable reference for your next Playwright project.