The scraping course teaches cookies you can look at

Week three of the data-collection course is authentication, and authentication is where scraping tutorials go vague. Not here: the class curl service keeps cookie sessions as inspectable objects.

A student logs into the practice site under a session_id; the cookie jar updates after every request and persists until deleted. GET /api/v1/curl/sessions lists every session sorted by last use. The student watches the CSRF cookie appear on the login response, sees it ride along on the next request, deletes the session, and watches the site forget them.

The multi-step login stops being folklore. It's three requests and a visible jar.