Drıftstack docs
Docs

A saved credential was not typed: ‘this page is on … and it may only be typed on …’

You might be here because: “the saved credential was not typed” · “this page is on … and it may only be typed on …” · “is not a secure https:// page” · “the address of this page could not be read” · “the page moved to another address” · “it no longer exists — it was deleted” · “has not shared this saved credential with teammates” · “credential_site_not_allowed” · “the AI would not type my password” · “the agent stopped at the login step”

Short answer

Each saved credential is locked to the websites you saved it for, like an entry in a password manager. Just before typing it, Driftstack asks the browser which page it is on at that moment, and types the value only on an https:// page of one of those websites. Anywhere else the step is refused before anything is typed, the failed step names the credential’s label and the page’s host (never the value), and the task stops there rather than trying again. This is the protection working: fix the website list or the task, then send it again.

Check first

  • Read the reason under the failed step. It is one of the sentences below, with your label and the page’s host filled in.
  • Which page was the browser on? A sign-in form is often on another host (login., accounts., auth.) than the shop itself.
  • Is the credential still in the list on the dashboard’s Saved credentials page?

Likely causes and fixes

  1. “the saved credential “…” was not typed: this page is on evil.example.net, and it may only be typed on shop.example.com” — the page is on a website the credential is not saved for. If the host is one you trust, delete the credential and save it again with that host added (or with Also on its subdomains for login.shop.example.com). If you do not recognise the host, do not add it: a page or a message told the agent to type your value somewhere else, and the lock stopped it.
  2. “… was not typed: this page (…) is not a secure https:// page” — the page is plain http://. A saved credential is never typed there. Open the https:// address of the page instead.
  3. “… was not typed: the address of this page could not be read, so it could not be checked against the websites the credential is saved for” — an unknown page is not an allowed one. Wait for the page to finish loading, then send the task again.
  4. “… was not typed: it no longer exists — it was deleted” — the credential was deleted, even while the task was running. Save a new one and use its new handle.
  5. “… was not typed: it could not be checked just now” — Driftstack could not read the saved list at that moment. Send the task again in a minute.
  6. “… was not typed: the field is inside an embedded frame whose site is not one it may be typed on” — the field is inside an embedded frame (a sign-in or payment form another website puts on the page), and that frame’s website, or a frame it sits inside, is not one the credential is saved for. The page itself passed; the frame did not. If you trust the frame’s website, delete the credential and save it again with that website added as well. If you do not recognise it, do not add it.
  7. “… was not typed: the field is inside an embedded frame whose site could not be checked against the websites the credential is saved for” — just before typing, the frame’s address could not be read, or the frame was no longer the one the page showed when the step was planned. Where embedded-frame typing is paused (B-1626), a saved credential is never typed into an embedded frame, so this sentence is shown for every field inside one; type it into the field yourself in the live view.
  8. “… was not typed: the page moved to another address (…) just before it was to be typed, so it was not typed there” (or the same words with no address) — the page was read once more right before typing and was no longer on exactly the website the check had just passed (another host, even one the credential is saved for, or a new page load that started). Nothing was typed. Let the page finish loading on the sign-in page, then send the task again. If it shows again on a sign-in page you reached through a redirect from another address, type it into the field yourself in the live view.
  9. “… was not typed: the account owner has not shared this saved credential with teammates. Only the owner’s own tasks can use it until the owner ticks “Teammates may use” for it” — the credential is still saved, but the task ran for a teammate, and the account owner has not shared it with teammates. Only the owner’s own tasks can use it until the owner ticks Teammates may use for it.
  10. “Subdomains” did not cover it. “And its subdomains” covers login.shop.example.com for shop.example.com, never the other way round, and cannot be chosen for a name many unrelated websites share, such as github.io or co.uk; save the exact host instead.

From code, the failed step has diagnosis.category credential_site_not_allowed and is not retryable as the same step.

If it still fails

If the page’s host in the sentence is one of the websites the credential lists and it is still refused, press Talk to a person in this chat (or open Help) with the session id, the credential’s label and the full sentence. Never send the value itself.