Public Customer Login Surface Signal Agent

Analyze public customer login, sign-in, SSO, auth, or portal entry pages for visible authentication-surface evidence: login fields, SSO providers, enterprise SSO/SAML/Okta signals, MFA/security copy, passwordless/passkey signals, recovery links, signup/legal links, diagnostics, and stable hashes.

This Actor is for AI agents, RevOps teams, product marketers, customer-success ops, and competitive-intelligence workflows that need to monitor public auth surface changes without logging in, submitting forms, or crawling private account pages.

What It Returns

• Login surface type: form, form plus SSO, SSO-only, passwordless, or unknown.
• Identifier/password field hints from public HTML only.
• SSO providers and enterprise SSO/SAML/Okta evidence.
• MFA/security, passkey/passwordless, CAPTCHA/challenge, recovery, signup, and legal-link signals.
• Focus-term matches, evidence snippets, evidence URLs, diagnostics, quality/confidence/completeness scores, and a stable loginSurfaceHash.

Pricing Behavior

The Actor uses pay-per-event pricing and only charges the useful result event when it finds useful, new or changed public login-surface evidence.

Paid event:

• useful-customer-login-surface-result

It does not charge the useful event for:

• invalid or private-network URLs;
• failed fetches;
• query strings, fragments, credentials, reset/invite/token paths, or token-like account paths;
• generic home, trial/signup, demo/contact, pricing, blog, or landing pages;
• pages that only say "login required" but expose no public form, SSO, or passwordless evidence;
• focusTerms misses;
• unchanged records when you pass a previous loginSurfaceHash;
• duplicate normalized URLs in the same run.

apify-default-dataset-item is intentionally not used.

Scope And Safety

• Public HTTP/HTTPS HTML or text pages only.
• JavaScript is not executed.
• Forms are not submitted and credentials are never collected.
• Recovery, signup, legal, and SSO URLs are recorded only as sanitized links and are not fetched.
• Private-network hosts, credentials, query strings, fragments, path parameters, reset/invite/token paths, and token-like path segments are rejected.
• The Actor is not a security scanner, compliance audit, phishing detector, or private-account crawler.

Example Input

{
  "loginPageUrls": [
    "https://github.com/login"
  ],
  "focusTerms": [
    "password"
  ],
  "requestTimeoutSecs": 20
}

Best Use Cases

• Monitor when a vendor adds/removes visible SSO, SAML, MFA, passkey, or passwordless login options.
• Build lightweight competitive auth-surface evidence for battlecards.
• Check whether public customer portals expose enough login evidence for AI research pipelines.
• Avoid paying again for unchanged public login pages by passing previous records.