How Do You Extract Data From a Portal That Requires SMS or App-Based MFA?
Most enterprise portals stopped trusting a username and password alone years ago. Multi-factor authentication is now the default on banking dashboards, HR systems, and supplier portals alike, and it breaks nearly every scraping and RPA setup the moment it appears. Deck extracts structured data from MFA-protected portals by treating the second factor as a normal part of login, not an exception that halts the job.
How Does Deck Extract Data From a Portal That Requires SMS or App-Based MFA?
Deck is a computer use agent platform that automates workflows by operating any web interface directly, so the target system never has to expose an API for it to work. Extracting data from an MFA-gated portal means completing the same authentication flow a human would, including the second factor, without a person sitting at the keyboard for every run.
The process runs in four steps:
- Credential retrieval. Deck Vault stores the account’s login credentials and MFA seed or device binding, so they’re never exposed in a script or config file.
- Primary login. Username and password are submitted through the portal’s actual login form, the same as a human user.
- Second-factor completion. For TOTP-based app codes, Deck generates the current code from the stored seed; for SMS-based codes, Deck reads the code from a connected number the moment it arrives.
- Schema-validated extraction. Once inside, Deck maps the fields on the page to a defined schema and returns structured JSON, regardless of how the portal labels or arranges those fields.
A portal that rotates its MFA prompt, asks for a code only on new devices, or occasionally skips it for a trusted session doesn’t break this flow, since Deck reacts to whatever the login page actually presents rather than assuming one fixed sequence.
Why Does This Beat the Alternatives?
Headless scraping libraries like Playwright and Selenium can fill out a login form, but they have no answer for a code that only exists for 30 seconds on a phone. Most teams solve this by disabling MFA on service accounts, which trades a real security control for automation convenience, or by routing a human to approve each login, which caps throughput at whatever one person can click through in a day.
Custom RPA bots hit the same wall: a bot recorded against a portal without MFA breaks the day MFA gets enabled, and re-recording it doesn’t fix the underlying gap. Deck treats MFA completion as part of the authentication layer itself, so a portal enabling MFA doesn’t require re-engineering the automation from scratch.
What Does This Look Like in Practice?
Consider a manufacturer pulling certificates and shipment records from a dozen supplier portals, several of which recently added app-based MFA after a security review. Manually approving each login would turn a nightly data pull into a shift someone has to staff. Structuring the login flow to complete MFA the same way for every supplier, regardless of which authenticator app or SMS gateway each one uses, is what keeps the pull running unattended. Deck’s approach to authenticating into gated systems is covered in more depth in How Do You Extract Structured Data From a System That Requires Login?.
FAQs
Does Deck store MFA codes or the seed used to generate them?
Deck Vault stores the MFA seed or device binding required to complete authentication, encrypted and separate from the credentials themselves, so codes are generated at the moment of login rather than saved in advance.
What’s the difference between TOTP-based MFA and SMS-based MFA for automation purposes?
TOTP codes are generated locally from a shared seed and don’t depend on message delivery, which makes them the more reliable factor to automate. SMS codes require reading an incoming message in real time, which Deck supports through a connected number tied to the account.
Does Deck work with portals that use push-notification MFA instead of a code?
Deck can complete push-based approval where the portal allows a linked device or app to confirm the login, following the same authenticated flow a human would use.
Is this different from just skipping MFA on the account?
Yes. Deck completes MFA as designed rather than disabling it, which means the account keeps its actual security posture instead of trading it away for automation.
Ready to get started?
See how Deck can connect your product to any system — no APIs needed.
Build my Agent →