diff --git a/cmd/cloudx/accountexperience/accountexperience_test.go b/cmd/cloudx/accountexperience/accountexperience_test.go
index 184d29de..0f237311 100644
--- a/cmd/cloudx/accountexperience/accountexperience_test.go
+++ b/cmd/cloudx/accountexperience/accountexperience_test.go
@@ -8,6 +8,9 @@ import (
 	"strings"
 	"testing"
 
+	cloud "github.com/ory/client-go"
+	"github.com/ory/x/cmdx"
+
 	"github.com/stretchr/testify/assert"
 
 	"github.com/stretchr/testify/require"
@@ -16,22 +19,22 @@ import (
 	"github.com/ory/cli/cmd/cloudx/testhelpers"
 )
 
+var (
+	ctx     context.Context
+	project *cloud.Project
+	cmd     *cmdx.CommandExecuter
+)
+
 func TestMain(m *testing.M) {
+	ctx, _, _, project, cmd = testhelpers.CreateDefaultAssetsBrowser()
 	testhelpers.UseStaging()
 	m.Run()
 }
 
 func TestOpenAXPages(t *testing.T) {
-	_, _, _, sessionToken := testhelpers.RegisterAccount(context.Background(), t)
-	ctx := client.ContextWithOptions(context.Background(),
-		client.WithConfigLocation(testhelpers.NewConfigFile(t)),
-		client.WithSessionToken(t, sessionToken))
-	project := testhelpers.CreateProject(ctx, t, nil)
-	cmd := testhelpers.Cmd(ctx)
-
 	t.Run("is able to open all pages", func(t *testing.T) {
 		for _, flowType := range []string{"login", "registration", "recovery", "verification", "settings"} {
-			testhelpers.Cmd(client.ContextWithOptions(ctx, client.WithOpenBrowserHook(func(uri string) error {
+			cmd := testhelpers.Cmd(client.ContextWithOptions(ctx, client.WithOpenBrowserHook(func(uri string) error {
 				assert.Truef(t, strings.HasPrefix(uri, "https://"+project.Slug), "expected %q to have prefix %q", uri, "https://"+project.Slug)
 				assert.Contains(t, uri, flowType)
 				return nil
diff --git a/cmd/cloudx/client/auth.go b/cmd/cloudx/client/auth.go
index 9c96bcc0..3d44d663 100644
--- a/cmd/cloudx/client/auth.go
+++ b/cmd/cloudx/client/auth.go
@@ -181,7 +181,7 @@ func (h *CommandHelper) oAuth2DanceWithServer(ctx context.Context, client *oauth
 		l            net.Listener
 		state        = randx.MustString(32, randx.AlphaNum)
 		pkceVerifier = oauth2.GenerateVerifier()
-		ports        = []int{12345, 34525, 49763, 51238, 59724, 60582, 62125}
+		ports        = []int{12345, 15793, 17628, 19834, 23730, 27462, 34525, 36209, 42827, 46718, 49763, 51238, 52213, 57923, 59724, 60582, 62125, 65321, 49876, 54321, 59876, 60987, 62345, 63456, 64567, 65123, 65234, 65432, 65500, 65510, 65520, 65530}
 	)
 	rand.Shuffle(len(ports), func(i, j int) { ports[i], ports[j] = ports[j], ports[i] })
 	for _, port := range ports {
diff --git a/cmd/cloudx/client/command_helper.go b/cmd/cloudx/client/command_helper.go
index 5835e92e..9238162e 100644
--- a/cmd/cloudx/client/command_helper.go
+++ b/cmd/cloudx/client/command_helper.go
@@ -13,13 +13,9 @@ import (
 	"os"
 	"os/user"
 	"strings"
-	"testing"
-
-	"github.com/pkg/browser"
-
-	"github.com/ory/x/pointerx"
 
 	"github.com/gofrs/uuid"
+	"github.com/pkg/browser"
 	"github.com/pkg/errors"
 	"github.com/spf13/cobra"
 	"github.com/tidwall/gjson"
@@ -28,6 +24,7 @@ import (
 	"github.com/ory/x/cmdx"
 	"github.com/ory/x/flagx"
 	"github.com/ory/x/jsonx"
+	"github.com/ory/x/pointerx"
 )
 
 const (
@@ -53,7 +50,6 @@ type (
 		openBrowserHook   func(string) error
 		projectAPIKey     *string
 		workspaceAPIKey   *string
-		sessionToken      *string
 	}
 	helperOptionsContextKey struct{}
 	CommandHelperOption     func(*CommandHelper)
@@ -121,12 +117,6 @@ func WithWorkspaceAPIKey(apiKey string) CommandHelperOption {
 	}
 }
 
-func WithSessionToken(_ testing.TB, sessionToken string) CommandHelperOption {
-	return func(h *CommandHelper) {
-		h.sessionToken = &sessionToken
-	}
-}
-
 func WithOpenBrowserHook(openBrowser func(string) error) CommandHelperOption {
 	return func(h *CommandHelper) {
 		h.openBrowserHook = openBrowser
diff --git a/cmd/cloudx/client/command_helper_test.go b/cmd/cloudx/client/command_helper_test.go
index a23f4bbc..c3b00356 100644
--- a/cmd/cloudx/client/command_helper_test.go
+++ b/cmd/cloudx/client/command_helper_test.go
@@ -44,9 +44,10 @@ func TestMain(m *testing.M) {
 }
 
 func TestCommandHelper(t *testing.T) {
+	defaultConfigFile := testhelpers.NewConfigFile(t)
 	ctx := client.ContextWithOptions(
 		context.Background(),
-		client.WithConfigLocation(testhelpers.NewConfigFile(t)),
+		client.WithConfigLocation(defaultConfigFile),
 		client.WithNoConfirm(true),
 		client.WithQuiet(true),
 		client.WithVerboseErrWriter(io.Discard),
@@ -55,9 +56,16 @@ func TestCommandHelper(t *testing.T) {
 		}))
 
 	email, password, name, sessionToken := testhelpers.RegisterAccount(ctx, t)
-	defaultConfigFile := testhelpers.NewConfigFile(t)
-	authenticated, err := client.NewCommandHelper(ctx, client.WithConfigLocation(defaultConfigFile), client.WithSessionToken(t, sessionToken))
+
+	browser, page, cleanup := testhelpers.SetupPlaywright(t)
+	t.Cleanup(cleanup)
+	authenticated, err := client.NewCommandHelper(
+		ctx,
+		client.WithQuiet(false),
+		client.WithOpenBrowserHook(testhelpers.PlaywrightAcceptConsentBrowserHook(t, page, email, password)),
+	)
 	require.NoError(t, err)
+	require.NoError(t, authenticated.Authenticate(ctx))
 
 	defaultWorkspace, err := authenticated.CreateWorkspace(ctx, randx.MustString(6, randx.AlphaNum))
 	require.NoError(t, err)
@@ -79,14 +87,14 @@ func TestCommandHelper(t *testing.T) {
 
 	t.Run("func=SelectProjectWorkspace", func(t *testing.T) {
 		t.Parallel()
-		h, err := client.NewCommandHelper(ctx, client.WithSessionToken(t, sessionToken), client.WithConfigLocation(defaultConfigFile))
+		h, err := client.NewCommandHelper(ctx)
 		require.NoError(t, err)
 		otherProject, err := h.CreateProject(ctx, "other project", "dev", &defaultWorkspace.Id, false)
 		require.NoError(t, err)
 
 		t.Run("can change the selected project and workspace", func(t *testing.T) {
 			// create new helper to ensure clean internal state
-			h, err := client.NewCommandHelper(ctx, client.WithSessionToken(t, sessionToken), client.WithConfigLocation(defaultConfigFile))
+			h, err := client.NewCommandHelper(ctx)
 			require.NoError(t, err)
 
 			current, err := h.ProjectID()
@@ -105,7 +113,7 @@ func TestCommandHelper(t *testing.T) {
 			assert.Equal(t, defaultWorkspace.Id, *actualWorkspace)
 
 			// check if persistent across instances
-			h, err = client.NewCommandHelper(ctx, client.WithSessionToken(t, sessionToken), client.WithConfigLocation(defaultConfigFile))
+			h, err = client.NewCommandHelper(ctx)
 			require.NoError(t, err)
 
 			current, err = h.ProjectID()
@@ -117,10 +125,19 @@ func TestCommandHelper(t *testing.T) {
 	t.Run("func=ListProjects", func(t *testing.T) {
 		t.Parallel()
 
-		configFile := testhelpers.NewConfigFile(t)
-		_, _, _, sessionToken := testhelpers.RegisterAccount(ctx, t)
+		ctx := client.ContextWithOptions(ctx, client.WithConfigLocation(testhelpers.NewConfigFile(t)))
+		email, password, _, _ := testhelpers.RegisterAccount(ctx, t)
+		page, err := browser.NewPage()
+		require.NoError(t, err)
+		authenticated, err := client.NewCommandHelper(
+			ctx,
+			client.WithQuiet(false),
+			client.WithOpenBrowserHook(testhelpers.PlaywrightAcceptConsentBrowserHook(t, page, email, password)),
+		)
+		require.NoError(t, err)
+		require.NoError(t, authenticated.Authenticate(ctx))
 
-		h, err := client.NewCommandHelper(ctx, client.WithSessionToken(t, sessionToken), client.WithConfigLocation(configFile))
+		h, err := client.NewCommandHelper(ctx)
 		require.NoError(t, err)
 
 		t.Run("empty list", func(t *testing.T) {
@@ -161,9 +178,9 @@ func TestCommandHelper(t *testing.T) {
 
 	t.Run("func=CreateProject", func(t *testing.T) {
 		t.Parallel()
-		configPath := testhelpers.NewConfigFile(t)
+		ctx := testhelpers.WithDuplicatedConfigFile(ctx, t, defaultConfigFile)
 
-		h, err := client.NewCommandHelper(ctx, client.WithSessionToken(t, sessionToken), client.WithConfigLocation(configPath))
+		h, err := client.NewCommandHelper(ctx)
 		require.NoError(t, err)
 		workspace, err := h.CreateWorkspace(ctx, t.Name())
 		require.NoError(t, err)
@@ -196,19 +213,12 @@ func TestCommandHelper(t *testing.T) {
 	t.Run("func=Authenticate", func(t *testing.T) {
 		t.Parallel()
 
-		_, page, cleanup := testhelpers.SetupPlaywright(t)
-		t.Cleanup(cleanup)
-
-		// ensure the browser has a valid session cookie
-		testhelpers.BrowserLogin(t, page, email, password)
-		t.Logf("browser login successful")
-
 		// set up the command helper
 		ctx := client.ContextWithOptions(ctx, client.WithConfigLocation(testhelpers.NewConfigFile(t)))
 		h, err := client.NewCommandHelper(
 			ctx,
 			client.WithQuiet(false),
-			client.WithOpenBrowserHook(testhelpers.PlaywrightAcceptConsentBrowserHook(t, page, password)),
+			client.WithOpenBrowserHook(testhelpers.PlaywrightAcceptConsentBrowserHook(t, page, email, password)),
 		)
 		require.NoError(t, err)
 
@@ -312,7 +322,7 @@ func TestCommandHelper(t *testing.T) {
 			t.Run("is not able to get project if not authenticated and quiet flag "+name, func(t *testing.T) {
 				t.Parallel()
 
-				h, err := client.NewCommandHelper(ctx, client.WithQuiet(true))
+				h, err := client.NewCommandHelper(ctx, client.WithConfigLocation(testhelpers.NewConfigFile(t)), client.WithQuiet(true))
 				require.NoError(t, err)
 				_, err = h.GetProject(ctx, p.Id, p.WorkspaceId.Get())
 				assert.ErrorIs(t, err, client.ErrNoConfigQuiet)
diff --git a/cmd/cloudx/client/sdks.go b/cmd/cloudx/client/sdks.go
index 376b1f8c..346d9a49 100644
--- a/cmd/cloudx/client/sdks.go
+++ b/cmd/cloudx/client/sdks.go
@@ -68,12 +68,6 @@ func NewPublicOryProjectClient() *cloud.APIClient {
 	return cloud.NewAPIClient(conf)
 }
 
-func NewConsoleAPIClient(sessionToken string) *cloud.APIClient {
-	conf := newSDKConfiguration(CloudConsoleURL("api").String())
-	conf.HTTPClient = newOAuth2TokenClient(oauth2.StaticTokenSource(&oauth2.Token{AccessToken: sessionToken}))
-	return cloud.NewAPIClient(conf)
-}
-
 func (h *CommandHelper) newConsoleAPIClient(ctx context.Context) (_ *cloud.APIClient, err error) {
 	conf := newSDKConfiguration(CloudConsoleURL("api").String())
 	conf.HTTPClient, err = h.newConsoleHTTPClient(ctx)
@@ -87,8 +81,6 @@ func (h *CommandHelper) newConsoleHTTPClient(ctx context.Context) (*http.Client,
 	// use the workspace API key if set
 	if h.workspaceAPIKey != nil {
 		return newOAuth2TokenClient(oauth2.StaticTokenSource(&oauth2.Token{AccessToken: *h.workspaceAPIKey})), nil
-	} else if h.sessionToken != nil {
-		return newOAuth2TokenClient(oauth2.StaticTokenSource(&oauth2.Token{AccessToken: *h.sessionToken})), nil
 	}
 
 	// fall back to interactive OAuth2 flow
@@ -103,8 +95,6 @@ func (h *CommandHelper) newConsoleHTTPClient(ctx context.Context) (*http.Client,
 func (h *CommandHelper) ProjectAuthToken(ctx context.Context) (oauth2.TokenSource, func(string) *url.URL, error) {
 	if h.projectAPIKey != nil {
 		return oauth2.StaticTokenSource(&oauth2.Token{AccessToken: *h.projectAPIKey}), CloudAPIsURL, nil
-	} else if h.sessionToken != nil {
-		return oauth2.StaticTokenSource(&oauth2.Token{AccessToken: *h.sessionToken}), CloudConsoleURL, nil
 	}
 
 	config, err := h.GetAuthenticatedConfig(ctx)
diff --git a/cmd/cloudx/identity/main_test.go b/cmd/cloudx/identity/main_test.go
index 890e0d80..d61d7733 100644
--- a/cmd/cloudx/identity/main_test.go
+++ b/cmd/cloudx/identity/main_test.go
@@ -20,6 +20,6 @@ var (
 )
 
 func TestMain(m *testing.M) {
-	ctx, _, _, defaultProject, defaultCmd = testhelpers.CreateDefaultAssets()
+	ctx, _, _, defaultProject, defaultCmd = testhelpers.CreateDefaultAssetsBrowser()
 	m.Run()
 }
diff --git a/cmd/cloudx/oauth2/client_test.go b/cmd/cloudx/oauth2/client_test.go
index 04f3db6e..50a2549c 100644
--- a/cmd/cloudx/oauth2/client_test.go
+++ b/cmd/cloudx/oauth2/client_test.go
@@ -27,7 +27,7 @@ var (
 )
 
 func TestMain(m *testing.M) {
-	ctx, _, _, defaultProject, defaultCmd = testhelpers.CreateDefaultAssets()
+	ctx, _, _, defaultProject, defaultCmd = testhelpers.CreateDefaultAssetsBrowser()
 	m.Run()
 }
 
diff --git a/cmd/cloudx/organizations/organizations_test.go b/cmd/cloudx/organizations/organizations_test.go
index 0f690824..052e3d88 100644
--- a/cmd/cloudx/organizations/organizations_test.go
+++ b/cmd/cloudx/organizations/organizations_test.go
@@ -23,7 +23,7 @@ var (
 )
 
 func TestMain(m *testing.M) {
-	_, _, _, defaultProject, defaultCmd = testhelpers.CreateDefaultAssets()
+	_, _, _, defaultProject, defaultCmd = testhelpers.CreateDefaultAssetsBrowser()
 	m.Run()
 }
 
diff --git a/cmd/cloudx/project/list_test.go b/cmd/cloudx/project/list_test.go
index 9a3a5f55..8e48d688 100644
--- a/cmd/cloudx/project/list_test.go
+++ b/cmd/cloudx/project/list_test.go
@@ -22,10 +22,21 @@ func TestListProject(t *testing.T) {
 	t.Parallel()
 
 	// this test needs a separate account to properly list projects
-	_, _, _, sessionToken := testhelpers.RegisterAccount(context.Background(), t)
 	ctx := client.ContextWithOptions(ctx,
-		client.WithSessionToken(t, sessionToken),
 		client.WithConfigLocation(testhelpers.NewConfigFile(t)))
+
+	email, password, _, _ := testhelpers.RegisterAccount(context.Background(), t)
+	_, page, cleanup := testhelpers.SetupPlaywright(t)
+	t.Cleanup(cleanup)
+	h, err := client.NewCommandHelper(
+		ctx,
+		client.WithQuiet(false),
+		client.WithOpenBrowserHook(testhelpers.PlaywrightAcceptConsentBrowserHook(t, page, email, password)),
+	)
+	require.NoError(t, err)
+	require.NoError(t, h.Authenticate(ctx))
+	cleanup()
+
 	cmd := testhelpers.Cmd(ctx)
 
 	projects := make([]*cloud.Project, 3)
diff --git a/cmd/cloudx/project/main_test.go b/cmd/cloudx/project/main_test.go
index 16fc07d6..69107f9e 100644
--- a/cmd/cloudx/project/main_test.go
+++ b/cmd/cloudx/project/main_test.go
@@ -21,6 +21,6 @@ var (
 )
 
 func TestMain(m *testing.M) {
-	ctx, defaultConfig, extraProject, defaultProject, defaultCmd = testhelpers.CreateDefaultAssets()
+	ctx, defaultConfig, extraProject, defaultProject, defaultCmd = testhelpers.CreateDefaultAssetsBrowser()
 	m.Run()
 }
diff --git a/cmd/cloudx/project/patch_test.go b/cmd/cloudx/project/patch_test.go
index 886b170c..b9ffda0c 100644
--- a/cmd/cloudx/project/patch_test.go
+++ b/cmd/cloudx/project/patch_test.go
@@ -21,54 +21,54 @@ func TestPatchProject(t *testing.T) {
 		{
 			name: "is able to replace a key",
 			doPatch: func(t *testing.T, exec execFunc) {
-				stdout, _, err := exec(nil, "patch", "project", "--format", "json", "--replace", `/services/identity/config/selfservice/methods/password/enabled=false`)
-				require.NoError(t, err)
+				stdout, stderr, err := exec(nil, "patch", "project", "--format", "json", "--replace", `/services/identity/config/selfservice/methods/password/enabled=false`)
+				require.NoError(t, err, "stdout: %s\nstderr: %s", stdout, stderr)
 				assert.False(t, gjson.Get(stdout, "services.identity.config.selfservice.methods.password.enabled").Bool())
 			},
 		},
 		{
 			name: "is able to add a key",
 			doPatch: func(t *testing.T, exec execFunc) {
-				stdout, _, err := exec(nil, "patch", "project", "--format", "json", "--add", `/services/identity/config/selfservice/methods/password/enabled=false`)
-				require.NoError(t, err)
+				stdout, stderr, err := exec(nil, "patch", "project", "--format", "json", "--add", `/services/identity/config/selfservice/methods/password/enabled=false`)
+				require.NoError(t, err, "stdout: %s\nstderr: %s", stdout, stderr)
 				assert.False(t, gjson.Get(stdout, "services.identity.config.selfservice.methods.password.enabled").Bool())
 			},
 		},
 		{
 			name: "is able to add a key with string",
 			doPatch: func(t *testing.T, exec execFunc) {
-				stdout, _, err := exec(nil, "patch", "project", "--format", "json", "--replace", "/services/identity/config/selfservice/flows/error/ui_url=\"https://example.com/error-ui\"")
-				require.NoError(t, err)
+				stdout, stderr, err := exec(nil, "patch", "project", "--format", "json", "--replace", "/services/identity/config/selfservice/flows/error/ui_url=\"https://example.com/error-ui\"")
+				require.NoError(t, err, "stdout: %s\nstderr: %s", stdout, stderr)
 				assert.Equal(t, "https://example.com/error-ui", gjson.Get(stdout, "services.identity.config.selfservice.flows.error.ui_url").String())
 			},
 		},
 		{
 			name: "is able to add a key with raw json",
 			doPatch: func(t *testing.T, exec execFunc) {
-				stdout, _, err := exec(nil, "patch", "project", "--format", "json", "--replace", `/services/identity/config/selfservice/flows/error={"ui_url":"https://example.org/error-ui"}`)
-				require.NoError(t, err)
+				stdout, stderr, err := exec(nil, "patch", "project", "--format", "json", "--replace", `/services/identity/config/selfservice/flows/error={"ui_url":"https://example.org/error-ui"}`)
+				require.NoErrorf(t, err, "stdout: %s\nstderr: %s", stdout, stderr)
 				assert.Equal(t, "https://example.org/error-ui", gjson.Get(stdout, "services.identity.config.selfservice.flows.error.ui_url").String())
 			},
 		},
 		{
 			name: "is able to remove a key",
 			doPatch: func(t *testing.T, exec execFunc) {
-				stdout, _, err := exec(nil, "patch", "project", "--format", "json", "--remove", `/services/identity/config/selfservice/methods/password/enabled`)
-				require.NoError(t, err)
+				stdout, stderr, err := exec(nil, "patch", "project", "--format", "json", "--remove", `/services/identity/config/selfservice/methods/password/enabled`)
+				require.NoErrorf(t, err, "stdout: %s\nstderr: %s", stdout, stderr)
 				assert.True(t, gjson.Get(stdout, "services.identity.config.selfservice.methods.password.enabled").Bool())
 			},
 		},
 		{
 			name: "fails if no opts are given",
 			doPatch: func(t *testing.T, exec execFunc) {
-				stdout, _, err := exec(nil, "patch", "project", "--format", "json")
-				require.Error(t, err, stdout)
+				stdout, stderr, err := exec(nil, "patch", "project", "--format", "json")
+				require.Errorf(t, err, "stdout: %s\nstderr: %s", stdout, stderr)
 			},
 		},
 		{
 			name: "is able to update several keys",
 			doPatch: func(t *testing.T, exec execFunc) {
-				stdout, _, err := exec(nil, "patch", "project", "--format", "json",
+				stdout, stderr, err := exec(nil, "patch", "project", "--format", "json",
 					"--replace", `/services/identity/config/selfservice/methods/link/enabled=true`,
 					"--replace", `/services/identity/config/selfservice/methods/oidc/enabled=true`,
 					"--remove", `/services/identity/config/selfservice/methods/profile/enabled`,
@@ -78,7 +78,7 @@ func TestPatchProject(t *testing.T) {
 					"-f", "fixtures/patch/1.json",
 					"-f", "fixtures/patch/2.json",
 				)
-				require.NoError(t, err)
+				require.NoErrorf(t, err, "stdout: %s\nstderr: %s", stdout, stderr)
 				assert.True(t, gjson.Get(stdout, "services.identity.config.selfservice.methods.password.enabled").Bool())
 				assert.True(t, gjson.Get(stdout, "services.identity.config.selfservice.methods.profile.enabled").Bool())
 				assert.True(t, gjson.Get(stdout, "services.identity.config.selfservice.methods.link.enabled").Bool())
@@ -92,8 +92,6 @@ func TestPatchProject(t *testing.T) {
 		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
 			runWithProjectAsDefault(ctx, t, defaultProject.Id, tc.doPatch)
 			runWithProjectAsArgument(ctx, t, extraProject.Id, tc.doPatch)
 		})
diff --git a/cmd/cloudx/testhelpers/testhelpers.go b/cmd/cloudx/testhelpers/testhelpers.go
index b0644f07..ad16928a 100644
--- a/cmd/cloudx/testhelpers/testhelpers.go
+++ b/cmd/cloudx/testhelpers/testhelpers.go
@@ -185,14 +185,6 @@ func CreateClient(ctx context.Context, t testing.TB, project string) gjson.Resul
 	return gjson.Parse(stdout)
 }
 
-func BrowserLogin(t testing.TB, page playwright.Page, email, password string) {
-	_, err := page.Goto(client.CloudConsoleURL("").String() + "/login")
-	require.NoError(t, err)
-	require.NoError(t, page.Locator(`[data-testid="node/input/identifier"] input`).Fill(email))
-	require.NoError(t, page.Locator(`[data-testid="node/input/password"] input`).Fill(password))
-	require.NoError(t, page.Locator(`[type="submit"][name="method"][value="password"]`).Click())
-}
-
 func RegisterAccount(ctx context.Context, t testing.TB) (email, password, name, sessionToken string) {
 	email, password, name = FakeAccount()
 	c := client.NewPublicOryProjectClient()
@@ -241,16 +233,26 @@ func SetupPlaywright(t testing.TB) (playwright.Browser, playwright.Page, func())
 	}
 }
 
-func PlaywrightAcceptConsentBrowserHook(t testing.TB, page playwright.Page, password string) func(uri string) error {
+func PlaywrightAcceptConsentBrowserHook(t testing.TB, page playwright.Page, email, password string) func(uri string) error {
 	return func(uri string) error {
 		t.Logf("open browser with %s", uri)
 
 		_, err := page.Goto(uri)
 		require.NoError(t, err)
 
-		// reconfirm password
-		require.NoError(t, page.Locator(`[data-testid="node/input/password"] input`).Fill(password))
-		require.NoError(t, page.Locator(`[type="submit"][name="method"][value="password"]`).Click())
+		if err := page.Locator(`[data-testid="node/input/identifier"] input`).WaitFor(); err == nil {
+			// we need to log in first
+			t.Logf("logging in")
+			require.NoError(t, page.Locator(`[data-testid="node/input/identifier"] input`).Fill(email))
+			require.NoError(t, page.Locator(`[data-testid="node/input/password"] input`).Fill(password))
+			require.NoError(t, page.Locator(`[type="submit"][name="method"][value="password"]`).Click())
+		} else {
+			// reconfirm password
+			t.Logf("reconfirming password")
+			require.NoError(t, page.Locator(`[data-testid="node/input/password"] input`).Fill(password))
+			require.NoError(t, page.Locator(`[type="submit"][name="method"][value="password"]`).Click())
+		}
+
 		// accept consent
 		require.NoError(t, page.Locator(`button:has-text("Allow")`).Click())
 
diff --git a/cmd/cloudx/testhelpers/testmain.go b/cmd/cloudx/testhelpers/testmain.go
index 894d7f0a..2c081303 100644
--- a/cmd/cloudx/testhelpers/testmain.go
+++ b/cmd/cloudx/testhelpers/testmain.go
@@ -11,7 +11,6 @@ import (
 	"runtime/debug"
 	"testing"
 
-	"github.com/pkg/errors"
 	"github.com/stretchr/testify/require"
 
 	cloud "github.com/ory/client-go"
@@ -41,48 +40,25 @@ func CreateDefaultAssetsBrowser() (ctx context.Context, defaultConfig string, ex
 
 	defaultConfig = NewConfigFile(t)
 
-	email, password, _, sessionToken := RegisterAccount(context.Background(), t)
-	ctx = client.ContextWithOptions(context.Background(),
-		client.WithConfigLocation(defaultConfig),
-		client.WithSessionToken(t, sessionToken))
-
-	defaultProject = CreateProject(ctx, t, nil)
-	extraProject = CreateProject(ctx, t, nil)
+	email, password, _, _ := RegisterAccount(context.Background(), t)
 
 	_, page, cleanup := SetupPlaywright(t)
 	defer cleanup()
-	BrowserLogin(t, page, email, password)
 
-	ctx = client.ContextWithOptions(context.Background(), client.WithConfigLocation(NewConfigFile(t)))
+	ctx = client.ContextWithOptions(context.Background(), client.WithConfigLocation(defaultConfig))
 	h, err := client.NewCommandHelper(
 		ctx,
 		client.WithQuiet(false),
-		client.WithOpenBrowserHook(PlaywrightAcceptConsentBrowserHook(t, page, password)),
+		client.WithOpenBrowserHook(PlaywrightAcceptConsentBrowserHook(t, page, email, password)),
 	)
 	require.NoError(t, err)
 	require.NoError(t, h.Authenticate(ctx))
-
-	defaultCmd = Cmd(ctx)
-	return
-}
-
-func CreateDefaultAssets() (ctx context.Context, defaultConfig string, extraProject, defaultProject *cloud.Project, defaultCmd *cmdx.CommandExecuter) {
-	UseStaging()
-
-	t := MockTestingTForMain{}
-
-	defaultConfig = NewConfigFile(t)
-
-	_, _, _, sessionToken := RegisterAccount(context.Background(), t)
-	ctx = client.ContextWithOptions(context.Background(),
-		client.WithConfigLocation(defaultConfig),
-		client.WithSessionToken(t, sessionToken),
-		client.WithOpenBrowserHook(func(uri string) error {
-			return errors.WithStack(fmt.Errorf("open browser hook not expected: %s", uri))
-		}))
+	// we don't need playwright anymore
+	cleanup()
 
 	defaultProject = CreateProject(ctx, t, nil)
 	extraProject = CreateProject(ctx, t, nil)
+
 	defaultCmd = Cmd(ctx)
 	return
 }