Documentation
Everything needed to install Auto Auth Filler, understand what each setting does, and work out what happened when a code does not appear.
Installing
Edge, Brave, Opera and Vivaldi install the Chrome package. Edge asks once for permission to use other stores. Safari is not supported, and the FAQ explains why.
| Browser | Status |
|---|---|
| Firefox 140 and newer | Supported |
| Chrome 102 and newer | Supported |
| Edge, Brave, Opera, Vivaldi | Supported, Chromium based |
| Firefox for Android | Declared in the manifest, never tested |
| Safari, iOS, iPadOS | Not supported |
Firefox 140 is the floor because it is the first version supporting the
data_collection_permissions manifest key that
addons.mozilla.org requires.
First run
- Click the extension icon in the toolbar.
- Click Sign in with Google and approve the read-only Gmail permission.
- You will see an unverified app warning. This is expected and is explained in the FAQ. Click Advanced, then continue.
- Visit any site that emails you a verification code. When the extension finds a code field, it enters the code and the overlay names the email it came from.
You sign in once. The extension stores a refresh token and renews access silently, so the consent screen does not come back.
Settings
Open the settings page from the popup footer.
| Setting | Default | What it does |
|---|---|---|
| Fill automatically | On | Enters the code as soon as it is found. Password fields always wait for a click regardless. |
| Auto-submit after filling | On | Activates the form's submit button once the field is filled. |
| Maximum code age | 10 minutes | Codes found in older emails are ignored. |
| Blocked domains | Empty | Domains, one per line, where the overlay never appears. |
| Language | Match browser | The interface language. Code detection understands English and German whatever this is set to. |
Troubleshooting
Nothing happens on a page that clearly wants a code
Detection is scored from the form itself, so an unusual field can fall
below the threshold. Open the browser console and look for lines starting
[Auto Auth Filler]; they report which step ran and why a
lookup stopped. A report with the field's label and length is genuinely
useful, and the
issue forms
ask for exactly that.
The overlay says a code was found but it is not filled
Most likely the sender does not match the site. A code is only entered when the message plausibly came from the site you are on, which is what stops one service's code being typed into another's form. The overlay shows the code so you can copy it, but will not enter it.
It keeps searching after I have already signed in
The lookup stays open briefly so that a rejected code can be replaced by a newer one. It closes once the code field disappears, which is how a successful sign-in is recognised.
Sign-in fails or the consent screen reappears
Press Sign out in the settings page and sign in again. If it persists, check that access has not been revoked at myaccount.google.com/permissions.
I do not want it running on a particular site
Add the domain to the blocklist in the settings page, one per line. The overlay will never appear there again.
Running from source
Use this to run an unreleased version or to run against your own Google Cloud project. Unlike a store install, this needs credentials of your own, because the published package carries its own and the repository does not.
The full steps, including creating the OAuth client and why it must be of type Web application, are in the README.
Adding a language
English and German are supported. Every language-dependent word lives in
vocabulary.js, and adding a language means editing that one
file.
Language matters in four places, and the first is the one that catches people out: the Gmail search query is a gate, not a filter, so a message the query does not match is never fetched and no pattern further down can recover it. The other three are the labels that locate a code inside a message, the words that identify a code field on a page and the text on the submit button.
Entries are regular expression fragments rather than plain strings. German
shows why: compounds like Bestätigungscode have no word
boundary before code, so a pattern written with
\b misses them entirely. For a language in a non-Latin script,
read the note at the top of the file first.
How it is built
Manifest V3, no build step, no framework and no runtime dependencies. Every file in the package is handwritten JavaScript, HTML and CSS, readable exactly as shipped.
| File | Responsibility |
|---|---|
background.js | OAuth, the Gmail search and extracting a code from a message |
content.js | Field detection, the overlay and filling |
vocabulary.js | Every language-dependent word, in one table |
i18n.js | The interface strings and the language switcher |
config.js | Your OAuth credentials. Git-ignored, never committed |
The test suite runs with node --test and needs nothing
installed. It covers code extraction against real email shapes, the PKCE
implementation against the RFC 7636 test vector, field scoring and the
translations.