# Authentication is a long-running Workflow

DevFeed: [Authentication is a long-running Workflow](<https://devfeed.tech/articles/authentication-is-a-long-running-workflow-35725.md>)

Original publisher: [Read original article](<https://temporal.io/blog/authentication-is-a-long-running-workflow>)

Author: Mason Williams

Published: 2026-09-15T00:00:00Z

Content type: tutorial

Language: en

Sources: [Temporal Blog](<https://devfeed.tech/sources/temporal-blog.md>)

Topics: [Authentication](<https://devfeed.tech/topics/authentication.md>), [MFA](<https://devfeed.tech/topics/mfa.md>), [browser](<https://devfeed.tech/topics/browser.md>), [Go Language](<https://devfeed.tech/topics/go-language.md>), [TypeScript](<https://devfeed.tech/topics/typescript.md>), [Deployment](<https://devfeed.tech/topics/deployment.md>), [push-notification](<https://devfeed.tech/topics/push-notification.md>), [sessions](<https://devfeed.tech/topics/sessions.md>), [API](<https://devfeed.tech/topics/api.md>)

Tags: [api](<https://devfeed.tech/tags/api.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [browser](<https://devfeed.tech/tags/browser.md>), [community](<https://devfeed.tech/tags/community.md>), [deployment](<https://devfeed.tech/tags/deployment.md>), [go](<https://devfeed.tech/tags/go.md>), [mfa](<https://devfeed.tech/tags/mfa.md>), [push-notification](<https://devfeed.tech/tags/push-notification.md>), [sessions](<https://devfeed.tech/tags/sessions.md>), [typescript](<https://devfeed.tech/tags/typescript.md>)

## AI overview

This article explains how KERNEL models Managed Auth as a long-running Temporal workflow. A parent workflow maintains connection state, health checks, reauthentication, and cancellation, while child workflows handle individual login attempts with separate browsers, timeouts, and cleanup. Durable state stays in Go, and model-driven work runs in a dedicated TypeScript Worker.

## Source excerpt

In this article# - A login is not a request - Model the connection, not the attempt - The human is part of the Workflow - Staying logged in is part of the product - Go owns durability; TypeScript runs the agent - What we learned 1. A login is not a request# An agent can enter a password, stop at an MFA prompt, wait for a person to approve a push notification, and then resume in the same browser. A deployment or Worker restart can happen anywhere in between.