Injected credentials

Entitlement: injectedCredentials. Configuration: internal.injected_credentials, an array. No JavaScript API or extendedPrefs entitlement is needed merely for the kernel to consume this section.

Configure a test login

{
  "internal": {
    "injected_credentials": [
      {
        "url": "https://example.com/login",
        "username": "sdk-test-user",
        "password": "replace-with-a-test-password"
      }
    ]
  }
}

Use your own test site and credentials. Merge into the EP, re-sign if required, and restart before opening the login page. Focus a recognized login field to test Chromium's autofill suggestions. This is not a guarantee of automatic submission or compatibility with every custom form.

Fields and matching

Each item needs string url, username, and password fields. The URL must be valid HTTP(S). Entries are grouped by Chromium's sign-on realm, not a CSS selector or exact page path. A credential for /login is not restricted to that path. Multiple entries for the same realm can supply multiple accounts.

Malformed entries and non-HTTP(S) URLs are skipped with a log. Fully restart after editing credentials; changing the file does not update a running instance.

Autofill without ordinary saved passwords

Injected credentials are offered for autofill but are not added as ordinary saved passwords. For matching login realms, the browser suppresses the corresponding save, update, and related password-management prompts. It does not ask to save the injected account as a newly discovered password.

Use passwords when you need actual saved-password import/export or change observation. Avoid supplying the same site/account through both mechanisms; they have different persistence and UI contracts.

Passwords remain readable in the file, including signed files. Restrict file access and avoid exposing them to pages through unrestrictedApi plus extendedPrefs.

Update and verify

Replace credentials in the instance EP, re-sign signed fields, and restart. Removing the overlay does not delete independently saved passwords from the Profile. If suggestions are missing, check the entitlement, EP verification, realm, recognized form, and whether you are testing the actual updated user-data directory.

Optional password reveal block changes supported reveal UI, but does not turn injected secrets into data the receiving site cannot access.