Drıftstack docs
Docs

A saved credential was not typed: ‘this page is on … and it may only be typed on …’

You might be here because: “the saved credential was not typed” · “this page is on … and it may only be typed on …” · “is not a secure https:// page” · “the address of this page could not be read” · “it no longer exists — it was deleted” · “credential_site_not_allowed” · “the AI would not type my password” · “the agent stopped at the login step”

Short answer

Each saved credential is locked to the websites you saved it for, like an entry in a password manager. Just before typing it, Driftstack asks the browser which page it is on at that moment, and types the value only on an https:// page of one of those websites. Anywhere else the step is refused before anything is typed, the failed step names the credential’s label and the page’s host (never the value), and the task stops there rather than trying again. This is the protection working: fix the website list or the task, then send it again.

Check first

  • Read the reason under the failed step. It is one of the sentences below, with your label and the page’s host filled in.
  • Which page was the browser on? A sign-in form is often on another host (login., accounts., auth.) than the shop itself.
  • Is the credential still in the list on the dashboard’s Saved credentials page?

Likely causes and fixes

  1. “the saved credential “…” was not typed: this page is on evil.example.net, and it may only be typed on shop.example.com” — the page is on a website the credential is not saved for. If the host is one you trust, delete the credential and save it again with that host added (or with Also on its subdomains for login.shop.example.com). If you do not recognise the host, do not add it: a page or a message told the agent to type your value somewhere else, and the lock stopped it.
  2. “… was not typed: this page (…) is not a secure https:// page” — the page is plain http://. A saved credential is never typed there. Open the https:// address of the page instead.
  3. “… was not typed: the address of this page could not be read, so it could not be checked against the websites the credential is saved for” — an unknown page is not an allowed one. Wait for the page to finish loading, then send the task again.
  4. “… was not typed: it no longer exists — it was deleted” — the credential was deleted, even while the task was running. Save a new one and use its new handle.
  5. “… was not typed: it could not be checked just now” — Driftstack could not read the saved list at that moment. Send the task again in a minute.
  6. “… was not typed: the field is inside an embedded frame whose site is not one it may be typed on” — the field is inside an embedded frame (a sign-in or payment form another website puts on the page), and that frame’s website, or a frame it sits inside, is not one the credential is saved for. The page itself passed; the frame did not. If you trust the frame’s website, delete the credential and save it again with that website added as well. If you do not recognise it, do not add it.
  7. “… was not typed: the field is inside an embedded frame whose site could not be checked against the websites the credential is saved for” — just before typing, the frame’s address could not be read, or the frame was no longer the one the page showed when the step was planned. Wait for the page to finish loading, then send the task again.
  8. “Subdomains” did not cover it. “And its subdomains” covers login.shop.example.com for shop.example.com, never the other way round, and cannot be chosen for a name many unrelated websites share, such as github.io or co.uk; save the exact host instead.

From code, the failed step has diagnosis.category credential_site_not_allowed and is not retryable as the same step.

If it still fails

If the page’s host in the sentence is one of the websites the credential lists and it is still refused, press Talk to a person in this chat (or open Help) with the session id, the credential’s label and the full sentence. Never send the value itself.