As of 16 October 2026, our agent signed up on its own at 45 of the 140 software products we drove, with no human step at sign-up: without a browser at 7 of 140, and in a browser at 38 of 140. The others asked for a person at sign-up, their form refused it, or they needed no sign-up at all: some hand an agent a database or a key with no account. For an owner, that makes the sign-up form the step to fix first; for a builder, it decides which products an agent can set up without a person.
Sign-up is the wall that ends the drive before verification or the key
Sign-up itself was the first checkpoint our agent did not pass on its own at 82 of 140 products we drove. A person was needed or the form refused it, so an emailed code or an API key never came up.
| Checkpoint | What happened | Products |
|---|---|---|
| Sign-up | Signed up without a browser | 7 of 140 |
| Sign-up | Signed up in a browser | 38 of 140 |
| Sign-up | Needed a human | 60 of 140 |
| Sign-up | The form refused our agent | 22 of 140 |
| Verification | Reached a verification step | 45 of 140 |
| Verification | Verified without a browser, of those that reached it | 12 of 45 |
| Key | Got as far as the key | 60 of 140 |
| Key | Got a key without a browser | 15 of 140 |
| Key | Copied the key from a dashboard in a browser | 35 of 140 |
Our agent signed up without a browser at AgentMail, Basecamp, Cloudinary, DocuSeal, Penpot, PlanetScale and SignWell. Penpot documents its sign-up RPCs in its API reference, and Cloudinary hands out a claimable cloud that carries its own key. A builder whose agent has no browser can start with these.
Our drives of 140 products, 1–16 Oct 2026 · The data
Data table
| Checkpoint | Reached it | Stopped here |
|---|---|---|
| Docs | 140 | 0 |
| Sign-up | 140 | 82 |
| Verify | 58 | 2 |
| Key | 56 | 3 |
| First call | 53 | 0 |
| First action | 53 | 3 |
| Pay | 50 | 24 |
| Cancel | 26 | 0 |
| Delete | 26 | 6 |
| Through every checkpoint | 20 |
Our agent got in on its own at 52 of 140 products
That count takes in every documented way in, including routes with no account. At Exa, our agent paid per call over x402 on its newest drive, though not on every recent one. Stripe’s CLI made a sandbox with restricted test keys, and Anchor Browser’s Agent Access flow returned an API key, both without an account.
Getting in on its own is what L2 Gets in names, on the scale L0 Read-only, L1 Needs a person, L2 Gets in, L3 Does the work, L4 Runs on its own, L5 Autonomous.
Our drives of 140 products, 1–16 Oct 2026 · The data
Data table
| Gets in on its own | With a person's help | Door stays closed | Total | |
|---|---|---|---|---|
| Products | 52 | 2 | 86 | 140 |
The same product doesn’t always answer the same way
10 of 140 products let our agent in on some recent drives and not on others: Acuity Scheduling, Apify, Exa, Intercom, Pipedrive, PostHog, Postiz, Salesforce, Supabase and TidyCal. At these products, the newest drive’s answer may not hold on the next one (how we drive).
PostHog is among them: on some recent drives it let our agent in, and on its newest drive it did not. There, its documented headless sign-up, a partner-only provisioning route, answered 403 (“Account creation is not enabled for this partner”) in the US and the EU. The web form ended in a visible Cloudflare Turnstile. Its docs are written for agents: llms.txt, a Markdown copy of every page, a public OpenAPI spec and an auth.md manifest.
Our drives of 140 products, 1–16 Oct 2026 · The data
Data table
| Products | Out of | Share | |
|---|---|---|---|
| Let our agent in on some drives, not others | 10 | 140 | 7% |
A bot check stopped sign-up at 73 of 82 products where sign-up was the first stop
At ActiveCampaign, the trial form led to a Cloudflare managed challenge, a visible Turnstile asking our agent to verify it is human. Our agent signs every request with Web Bot Auth. Signed, not verified: during these drives no bot-check provider listed our agent as a verified bot, so a check could see the signature but had no verified identity to trust.
Our drives of 140 products, 1–16 Oct 2026 · The data
Data table
| Products | Out of | Share | |
|---|---|---|---|
| Sign-ups a bot check stopped | 73 | 82 | 89% |
Where no bot check stood in the way, the form asked for something our agent did not have. Front requires a phone number and a job title at sign-up. Copper offers only Continue with Google. Neither form showed a CAPTCHA.
An owner on Cloudflare can match Web Bot Auth agents in a rule with the field cf.bot_management.signed_agent. The bot-check study breaks the stops down by provider.
21 of 140 products run on their own, and what they share
The products at L4 Runs on its own, where our agent got in, ran the core work and could stop paying without a person, are AgentMail, Airtable, Anchor Browser, Attio, Basecamp, Browserless, Buttondown, Cloudinary, DocuSeal, Fillout, Firecrawl, Formbricks, GitHub, NocoDB, Pipedream, Plane, Shortcut, Steel, Tally, Twenty and Zulip.
At sign-up, none of them asked for a phone number, a card or a Google-only account. Those are the asks that stopped other products at sign-up, such as the phone field at Zendesk and the card field at Fathom Analytics.
On recordAttioCRML4Runs on its ownFor an owner, the pattern to copy is a sign-up form that starts from an email address and a code or link sent to it. At Attio, a temporary password arrives by mail; at Tally, a code is typed on the page; at Steel, a sign-up link opens the account. At sign-up, Google reCAPTCHA let our agent through with no visible challenge at Fillout, Firecrawl and Twenty.
Our drives of 140 products, 1–16 Oct 2026 · The data
Data table
| Products | Out of | Share | |
|---|---|---|---|
| Products at L4 Runs on its own | 21 | 140 | 15% |
A sign-up call that returns a key, or no sign-up at all, both work for an agent
AgentMail documents a sign-up call for agents, and its llms.txt opens with the steps. The call returned an organization, an inbox and an API key in the same response. The emailed code arrived in seconds and was confirmed through the API.
On recordAgentMailEmail infrastructureL4Runs on its ownNeon needs no account at all. Its auth.md describes a claimable database, and neon claim create returned a working Postgres database, a Data API and Managed Better Auth in seconds. The database is temporary, and branching, restore and roles wait until a person claims it.
An owner can offer either: a sign-up call documented in llms.txt, as AgentMail does, or a resource an agent uses now and a person claims later, as Neon does.
A credential with no browser step, and a verification an agent can finish, already exist
Railway gives a credential with no browser step. Its documented ssh railway.new box carries a project token that worked with the CLI and the GraphQL API, and our agent made its first call and first action with it. Buttondown’s confirmation mail arrived within a minute, and its link worked without a browser.
Elsewhere, the browser comes back after sign-up. At Attio and Airtable, the token is made only in the web app’s settings. At Firecrawl, the confirmation link completes only in the browser that signed up.
Railway’s route is a separate, documented way in, so an owner can add one like it next to the sign-up form and keep the form’s bot check as it is. A confirmation link that completes wherever it is opened, as at Buttondown, lets an agent finish verification on its own. A key the API can mint, as at Penpot and Zulip, takes the dashboard out of the path.
