OpenAI Agents API computer use: gate origins, sign-in, retries, and consequential actions

Author: Ahab · Date: October 1, 2026

Quick answer

OpenAI added computer use to the Agents API on September 29, 2026. An agent can now work in an OpenAI-hosted browser, but the application still owns the important authority decisions: approving each website origin, collecting supported sign-in credentials outside the model, reconciling uncertain submissions, limiting consequential actions, and deleting the session after review. Do not treat an HTTP 202, an origin approval, or a completed turn as proof that a purchase, deletion, or sign-in is safe or successful.

Who this is for

This guide is for developers building browser-operating agents for support, research, or back-office automation, especially across public sites, authenticated pages, and high-impact actions.

If you first need a general permission model for browser agents, read the Chrome computer-use safety checklist. This article focuses on the newer Agents API contract and the application state you must add around it.

What changed and why it matters

The computer-use tool runs inside an OpenAI-hosted desktop. Your application adds { "type": "computer_use" } and follows session events while the agent navigates.

Network access alone does not authorize websites. When the browser needs a new origin, the session emits a browser_origin_access request. The application must show the requested origin and reason, then approve, deny, or cancel it. OpenAI also provides a dedicated browser-authentication flow for email addresses, passwords, and verification codes. Passkeys and QR-code sign-in are not supported, and only the main agent can request authentication.

These controls are not a complete safety system. Origin approval does not confirm every action, and website text cannot grant permission. Infrastructure must make purchases, deletions, publishing, and permission changes impossible or separately authorized.

Separate the four authority layers

Layer What it authorizes What it does not prove
Network access The hosted environment may reach the network A specific site is approved
Origin approval The browser may interact with one requested origin for the turn Individual clicks, purchases, deletions, or exports are approved
Browser authentication Credentials may be submitted through the dedicated event flow Sign-in succeeded, the right account was used, or the resulting action is allowed
Consequential-action gate Your application authorizes a named high-impact action The action completed correctly

Keep these states separate. One approved: true flag cannot explain what the user allowed.

A seven-step production workflow

1. Start with a minimal browser task contract

Define the task, allowed origins, account role, forbidden actions, output, timeout, and cleanup. Start with a read-only or reversible canary. Do not use an account that can spend money or administer production for a dashboard-reading task.

2. Deny unknown origins by default

Match the origin exactly and show the agent's reason. Approve only what the current step needs; deny look-alike domains, unexpected identity providers, shorteners, and destinations introduced only by page content.

3. Keep credentials outside the model

Collect credentials only after a real authentication request. Display and verify credential_origin, then use the dedicated session event. Never place credentials in chat, prompts, ordinary functions, telemetry, or retry logs.

4. Treat 202 as receipt, not success

An accepted origin decision does not mean navigation finished. An accepted credential submission does not mean sign-in succeeded. Continue reading the same session until the browser reaches an independently checkable postcondition, such as the expected account identity or authenticated page.

5. Reconcile uncertainty before retrying

Disable automatic retry for credential submissions. If the connection drops or the result is unknown, retrieve the same session and inspect its pending required_actions. Do not create a new session, resend credentials, or repeat a consequential click until you know the previous state.

6. Put high-impact actions behind infrastructure gates

For purchases, deletes, publishes, permission changes, and exports, require a separate server-side capability. A confirmation function helps only if the agent invokes it; capability restriction is stronger.

7. Review, export evidence, and delete the session

Record activity, approvals, authentication challenges, terminal state, and the verified result. Remove secrets from logs. Delete only after review; preserve and reconcile an uncertain session.

Approval and recovery receipt

Use one append-only record per run:

session_id: as_123
task: read_support_queue
allowed_origins:
  - https://support.example.com
origin_decisions:
  - origin: https://support.example.com
    decision: approve
    request_id: req_origin_1
auth:
  requested_by: main_agent
  credential_origin: https://support.example.com
  submission_http: 202
  sign_in_verified: true
forbidden_actions:
  - purchase
  - delete
  - publish
disconnect_reconciled: true
verified_result: queue_export_received
session_deleted: true

Separating submission, verification, and cleanup makes retries auditable and prevents an accepted request from becoming a false success claim.

Canary test matrix

Before production, test at least these cases: allowed origin, unapproved redirect, look-alike origin, page-injected approval language, supported password sign-in, unsupported passkey or QR flow, disconnect after credential submission, and attempted purchase or deletion. The run passes only when unknown origins stay blocked, secrets never enter model-visible text, uncertain submissions are reconciled without replay, and consequential actions remain impossible without a separate grant.

Common mistakes

Make your Mac notch useful with SuperNotch—more than 20 native tools for music, clipboard, focus, screenshots, system controls, and more.

FAQ

Does origin approval authorize a purchase or deletion?

No. It allows browser interaction with that origin for the turn. Build a separate server-side capability gate for consequential actions.

Does HTTP 202 mean sign-in succeeded?

No. It means the submission was accepted. Continue the session and verify the authenticated state independently.

Can a subagent request browser authentication?

No. The documented authentication flow is available to the main agent, not subagents.

What should happen after a disconnect?

Retrieve the same session, inspect pending required actions and saved activity, then resume or cancel. Do not automatically resend credentials or the task.

Sources