@@ -346,6 +346,39 @@ def session_for(data: dict, allow_private: bool = False) -> dict:
     return out
 
 
+def test_signin(slots: dict, allow_private: bool = False) -> list:
+    """Sign in now with each configured account, so an administrator can
+    confirm it works before a scan leans on it.  slots is {"a": data, "b":
+    data} from load().  -> a list of {slot, label, kind, kind_name,
+    configured, live, ok, detail}, in order.
+
+    A form login is signed in for real against the site.  A header or cookie
+    is reported as saved, since there is nothing here to sign into; it is sent
+    to the engines as given.  The second account's result is here too, which a
+    scan runs silently and never shows.
+    """
+    labels = {"a": "Account A", "b": "Account B (compare account)"}
+    out = []
+    for slot in ("a", "b"):
+        data = slots.get(slot) or {}
+        kind = data.get("kind", "")
+        row = {"slot": slot, "label": labels[slot], "kind": kind,
+               "kind_name": KINDS.get(kind, kind), "configured": bool(kind),
+               "live": kind == "form", "ok": False, "detail": ""}
+        if not kind:
+            out.append(row)
+            continue
+        if kind == "form":
+            sess = session_for(data, allow_private)
+            row["ok"], row["detail"] = sess["ok"], sess["detail"]
+        else:
+            row["ok"] = True
+            row["detail"] = ("saved and sent to the engines as given; there is "
+                             "nothing to sign into from here, so it is not tested live")
+        out.append(row)
+    return out
+
+
 def engine_args(tool: str, session: dict) -> list:
     """The command line options that sign an engine in.  [] when it cannot."""
     if not session or not session.get("kind"):
 
@@ -870,6 +870,36 @@ async def refresh_one(asset_id: int, request: Request, user: User = Depends(curr
                                                    "refreshes until it is done."))
 
 
+@router.post("/external/{asset_id}/test-signin")
+async def signin_test(asset_id: int, request: Request, user: User = Depends(current_user)):
+    """Sign in now with the saved account(s) so an admin can confirm they work
+    before a scan relies on them.  The second account is tested here too, which
+    a scan signs in with silently and never surfaces.  The live logins run off
+    the event loop so a slow site cannot stall other requests."""
+    from starlette.concurrency import run_in_threadpool
+
+    await check_csrf(request)
+    with session_scope() as db:
+        _guard(db, user)
+        asset = _asset(db, asset_id)
+        allow_private = external.options(db)["allow_private"]
+        slots = {"a": external_auth_mod.load(asset, "a"),
+                 "b": external_auth_mod.load(asset, "b")}
+    if not slots["a"].get("kind") and not slots["b"].get("kind"):
+        return redirect(_back(f"/external/{asset_id}",
+                              "No sign in is set for this site, so there is nothing to test.",
+                              "warn"))
+    results = await run_in_threadpool(external_auth_mod.test_signin, slots, allow_private)
+    parts, failed = [], False
+    for r in results:
+        if not r["configured"]:
+            continue
+        parts.append(f"{r['label']} ({r['kind_name'].lower()}): {r['detail']}")
+        failed = failed or not r["ok"]
+    return redirect(_back(f"/external/{asset_id}", "Sign in test.  " + "  ".join(parts),
+                          "warn" if failed else "ok"))
+
+
 @router.post("/external/{asset_id}/repos")
 async def link_repo(asset_id: int, request: Request, user: User = Depends(current_user)):
     """Link a repository by name, or confirm, hide or forget a found one."""
 
@@ -99,8 +99,17 @@
             {%- if auth.username %}, {{ auth.username }} at <span class="mono">{{ auth.login_url }}</span>{% endif %}
             <div class="faint small">The secret is saved encrypted and never shown.  Set {{ auth.set_at[:10] if auth.set_at else '' }}{% if auth.set_by %} by {{ auth.set_by }}{% endif %}.</div>
           {% else %}<span class="faint">none, scans see only the public site</span>{% endif %}</td></tr>
+        {% if auth_b and auth_b.kind %}<tr><th>Second account</th><td>{{ auth_b.kind_name }}
+            {%- if auth_b.username %}, {{ auth_b.username }} at <span class="mono">{{ auth_b.login_url }}</span>{% endif %}
+            <div class="faint small">The compare account that unlocks the two account access checks.  Saved encrypted.  Set {{ auth_b.set_at[:10] if auth_b.set_at else '' }}{% if auth_b.set_by %} by {{ auth_b.set_by }}{% endif %}.</div></td></tr>{% endif %}
         {% if asset.notes %}<tr><th>Comments</th><td class="small" style="white-space:pre-wrap">{{ asset.notes }}</td></tr>{% endif %}
       </tbody></table>
+      {% if (auth and auth.kind) or (auth_b and auth_b.kind) %}
+      <form method="post" action="{{ base }}/external/{{ asset.id }}/test-signin" style="margin-top:.6rem">
+        <input type="hidden" name="csrf_token" value="{{ csrf_token }}">
+        <button class="btn sm" type="submit">Test sign in</button>
+        <span class="faint small">Signs in now and reports whether each account works.  A form login is tried live against the site.</span></form>
+      {% endif %}
       <form method="post" action="{{ base }}/external/{{ asset.id }}/delete" data-confirm="Remove {{ asset.host }} and every scan recorded against it?" style="margin-top:.6rem">
         <input type="hidden" name="csrf_token" value="{{ csrf_token }}">
         <button class="btn sm danger" type="submit">Remove this site</button></form>