Sign in to Paycor Auth0

Purpose

Sign in to an existing Paycor account through the Auth0-hosted login flow, handling its separate identifier and password screens and any interactive verification prompt.

When to Use

Use when the caller supplies a current auth.paycor.com login URL and authorized credentials for an existing account. Do not use guessed or fabricated Auth0 state values.

Workflow

1. Navigate directly to the caller-provided {login-url} with waitUntil: "domcontentloaded". Preserve the complete URL, including its state and ui_locales query parameters.
2. If the identifier form is displayed, fill input#username with the securely supplied username/email and click button[name="action"]; wait for the next page or navigation.
3. On the password form, fill input#password with the securely supplied password and click button[name="action"].
4. If the site presents a CAPTCHA, MFA, consent, or other interactive verification challenge, pause for the authorized user or the browser's approved solver; never bypass it by guessing tokens.
5. Confirm completion by checking the resulting URL/page state with the evaluator below. A redirect to an authenticated Paycor application page is expected.

Concrete post-login state extractor (run on the current page):

(() => {
  const text = document.body?.innerText || "";
  const visible = (s) => {
    const e = document.querySelector(s);
    return !!e && !!(e.offsetWidth || e.offsetHeight || e.getClientRects().length);
  };
  const errors = [
    ...document.querySelectorAll('[role="alert"], .error, .error-message'),
  ]
    .map((e) => e.textContent.trim())
    .filter(Boolean);
  return {
    url: location.href,
    title: document.title,
    identifierFormVisible: visible("input#username"),
    passwordFormVisible: visible("input#password"),
    verificationPromptVisible:
      /captcha|verify|verification|multi.factor|authentication code/i.test(text),
    errors,
    likelyAuthenticated:
      !visible("input#username") &&
      !visible("input#password") &&
      errors.length === 0,
  };
})();

Site-Specific Gotchas

• This is a two-step Auth0 flow: the identifier is submitted before the password field becomes available; do not expect both fields on the initial screen.
• The submit control is button[name="action"] on both steps, while the fields are input#username and input#password.
• Auth0 state parameters are short-lived and transaction-specific. Preserve the complete supplied login URL and do not strip or invent the query string.
• Successful authentication may redirect away from auth.paycor.com to a Paycor application host such as hcm.paycor.com; judge success by the absence of login fields and the resulting authenticated page, not by host alone.
• Never include credentials, session cookies, state values, or MFA secrets in extracted output.

Expected Output

An authenticated Paycor session, typically followed by a redirect to the requested Paycor application. The extractor returns the final URL, title, visible login/verification state, any visible errors, and a boolean completion estimate.