Skip to main content

Accounts, Cookies & 2FA

Engagement modes (Like, Comment, Like comments, Subscribe) need the visitor to be signed in. AYB manages accounts per campaign through the Manage cookies & accounts workspace on Step 3: Identity. Accounts and cookies are campaign-scoped: each campaign carries its own set.

Two ways to sign in​

  1. Accounts (email + password): AYB logs the account in itself. Import them as a text list (.txt / .csv).
  2. Cookies: import an already-authenticated cookie session per account, so no live login is needed. More resilient and avoids repeated logins.

Both are added from the Import accounts / Import cookies buttons in the accounts workspace.

Account text format​

Import a .txt or .csv list, one account per line. The format is:

email:password
email:password|recoveryEmail
email:password|recoveryEmail|2FAsecretKey
  • email:password: required. Use a colon between them.
  • recoveryEmail: optional. A recovery email address Google may ask for during sign-in; must be a valid email.
  • 2FAsecretKey: optional. The account's TOTP/2FA secret (see below).
  • The separator before the optional fields can be | or :. | is clearest.

Examples:

[email protected]:Passw0rd!
[email protected]:Passw0rd!|[email protected]
[email protected]:Passw0rd!|[email protected]|JBSWY3DPEHPK3PXP
Recovery email

Providing a recovery email is recommended for Google accounts. Google sometimes asks for it during verification, and AYB will fill it automatically. Without one, an account that gets challenged may fail to log in.

Two-factor authentication (2FA)​

AYB supports Google accounts protected with authenticator-app (TOTP) 2FA. Put the account's 2FA secret key as the last field of the import line:

email:password|recoveryEmail|2FAsecretKey

The 2FA secret is the base-32 key you get when you set up an authenticator app (e.g. JBSWY3DPEHPK3PXP), not a 6-digit code. AYB generates the current one-time code from it during sign-in, so logins don't stall on the 2FA prompt.

Branded accounts​

To mark an account as a branded account (one Google account that owns multiple channels), prefix the line with branded::

branded:[email protected]:Passw0rd!|[email protected]|JBSWY3DPEHPK3PXP

See Branded Account Support for how branded accounts behave.

Instead of credentials, import authenticated cookies. Accepted formats are .txt, .json, or .cookies files:

  • One file per account, in Netscape or JSON cookie format.
  • The file name is the account's email, e.g. [email protected]. AYB uses the filename (minus extension) as the account identity, so the name must be exactly the email.
  • Import several at once (multi-select).

The reliable way to run a YouTube bot with logged-in accounts is cookies, not live password logins. Cookies skip the sign-in flow entirely, which means fewer challenges and captchas. The typical flow:

  1. Export each account's YouTube cookies from a browser (a cookie-export extension produces a Netscape .txt or a JSON file).
  2. Name each file after its account email ([email protected]).
  3. Import cookies into the campaign (multi-select all the files).
  4. Check cookies to see which sessions are still Valid.
  5. Remove expired so only working accounts run.
  6. Turn on Login with imported cookies (Step 3) so workers use the cookie session before falling back to a password login.

After importing, validate accounts with the built-in checker. Each account shows a status:

StatusMeaning
Not checkedImported but not yet validated
ValidCookies work / the account is logged in
ExpiredCookies no longer work
No cookiesAccount has credentials but no cookie session yet
  • Check cookies validates the set and reports Working / Expired counts.
  • Remove N expired deletes only the expired accounts.
  • Clear all removes every account and cookie session from the campaign.
  • Use proxy for cookie checker (a Connection option) runs validation through the campaign's proxies, so checks come from the same IPs the campaign will use.

Account behavior & dialog toggles​

On Step 3, Account behavior decides how accounts feed the workers:

  • Random from campaign accounts: a random account per visitor.
  • Use in listed order: accounts in sequence.
  • Do not log in: anonymous (fine for View-only campaigns).

The Manage cookies & accounts dialog mirrors this with two footer toggles:

  • Randomize accounts: pick a different account per eligible task.
  • Login with imported cookies: use valid cookie sessions before attempting a browser login.
tip

Pair accounts with saved browser profiles so an account stays signed into its own warmed-up profile between runs, rather than logging in fresh each time.

Format best practices​

  • Keep it one account per line. Blank lines and very short lines are skipped.
  • Use | as the separator for the optional recovery-email and 2FA fields; it's unambiguous. (A : also works, but if your password itself contains a colon, use | before the optional fields so it isn't misread.)
  • Recovery email must be a real address. The parser only accepts a valid email in that position; otherwise it's ignored.
  • The 2FA field is the secret key, not a 6-digit code: a base-32 string like JBSWY3DPEHPK3PXP. AYB generates the rotating code from it.
  • Match the account region to the proxy region where you can. A US account arriving from a Nigerian datacenter IP is an obvious mismatch.
  • Prefer cookies to passwords for accounts you already control. Fewer logins means fewer 2FA prompts and captchas.

Do's and don'ts​

Do

  • ✅ Validate every import with Check cookies and drop the Expired ones before running.
  • ✅ Turn on Use proxy for cookie checker so checks come from the same IPs the run will use. A cookie that's "valid" from your home IP may be challenged from a proxy.
  • ✅ Warm up new accounts with a Random act task (browse recommended/trending) before they like, comment, or subscribe.
  • ✅ Keep engagement Chance below 100% so likes/subscribes arrive gradually.
  • ✅ Persist logins by pairing accounts with saved browser profiles.

Don't

  • ❌ Don't name a cookie file anything but the account's email. AYB reads the identity from the filename.
  • ❌ Don't put a live 6-digit code in the 2FA field. Use the secret key.
  • ❌ Don't hammer one account across many videos in a short window. Spread work across accounts with Randomize accounts.
  • ❌ Don't reuse the same fresh cookies on wildly different IP geographies in the same session.
  • ❌ Don't run engagement modes with Do not log in. Likes, comments, and subscribes need a signed-in account.