diff --git a/.eslintrc.js b/.eslintrc.js
index eedfb6178..ad595695b 100644
--- a/.eslintrc.js
+++ b/.eslintrc.js
@@ -39,7 +39,10 @@ module.exports = {
 		"AvatarsPopup": false, "CreditsPopup": false, "FormatPopup": false, "FormattingPopup": false, "LoginPopup": false,
 		"MovePopup": false, "SoundsPopup": false, "OptionsPopup": false, "PromptPopup": false, "ProxyPopup": false, "ReconnectPopup": false,
 		"RegisterPopup": false, "ReplayUploadedPopup": false, "RulesPopup": false, "TabListPopup": false, "TournamentBox": false,
-		"CustomBackgroundPopup": false
+		"CustomBackgroundPopup": false,
+
+		// Test client
+		"POKEMON_SHOWDOWN_TESTCLIENT_KEY": false
 	},
 	"extends": "eslint:recommended",
 	"rules": {
diff --git a/README.md b/README.md
index 52da27b01..1dcca5bc3 100644
--- a/README.md
+++ b/README.md
@@ -28,7 +28,23 @@ other OSes) to build.
 
 You can make and test client changes simply by building after each change,
 and opening `testclient.html`. This will allow you to test changes to the
-client without setting up your own login server.
+client without setting up your own login server. For security reasons, browsers
+[restrict cross-origin HTTP requests][5] initiated from scripts (CORS), and as
+such to log in to the current test client you will be prompted to copy and
+paste the required information obtained via an iframe. Alternatively, you may
+all you need is to add a `config/testclient-key.js file`, with the contents:
+
+    const POKEMON_SHOWDOWN_TESTCLIENT_KEY = 'sid';
+
+Replace `sid` with the contents of your actual PS `sid` cookie. You can quickly
+access this on Chrome through the URL bar:
+
+![image](https://user-images.githubusercontent.com/551184/53414680-def43480-3994-11e9-89d0-c06098c23fa0.png)
+![image](https://user-images.githubusercontent.com/551184/53414760-119e2d00-3995-11e9-80f8-ecd17467310a.png)
+
+This is the only supported method of logging in on the beta Preact client.
+
+  [5]: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS
 
 You can connect to an arbitrary server by navigating to
 `testclient.html?~~host:port`. For example, to connect to a server running
@@ -70,12 +86,12 @@ just see the "Testing" section above.
 License
 ------------------------------------------------------------------------
 
-Pokémon Showdown's client is distributed under the terms of the [AGPLv3][5].
+Pokémon Showdown's client is distributed under the terms of the [AGPLv3][6].
 
 The reason is mostly because I don't want low-effort proprietary forks that add bad code that steals everyone's passwords, or something like that.
 
 If you're doing _anything_ else other than forking, _especially_ if you want to some client code files in your own open-source project that you want to release under a more permissive license (like, if you want to make your own multiplayer open-source game client for a different game), please ask at `staff@pokemonshowdown.com`. I hold all the copyright to the AGPLv3 parts and can relicense them to MIT for you.
 
-  [5]: http://www.gnu.org/licenses/agpl-3.0.html
+  [6]: http://www.gnu.org/licenses/agpl-3.0.html
 
 **WARNING:** This is **NOT** the same license as Pokémon Showdown's server.
diff --git a/js/storage.js b/js/storage.js
index 60601107f..6fca5e991 100644
--- a/js/storage.js
+++ b/js/storage.js
@@ -504,7 +504,14 @@ Storage.postCrossOriginMessage = function (data) {
 Storage.initTestClient = function () {
 	Config.server = Config.server || Config.defaultserver;
 	Storage.whenTeamsLoaded.load();
+
+	var sid = null;
+	if (typeof POKEMON_SHOWDOWN_TESTCLIENT_KEY === 'string') {
+		sid = POKEMON_SHOWDOWN_TESTCLIENT_KEY.replace(/\%2C/g, ',');
+	}
+
 	Storage.whenAppLoaded(function (app) {
+		var get = $.get;
 		$.get = function (uri, data, callback, type) {
 			if (type === 'html') {
 				uri += '&testclient';
@@ -518,8 +525,15 @@ Storage.initTestClient = function () {
 			if (uri[0] === '/') { // relative URI
 				uri = Dex.resourcePrefix + uri.substr(1);
 			}
-			app.addPopup(ProxyPopup, {uri: uri, callback: callback});
+
+			if (sid) {
+				data.sid = sid;
+				get(uri, data, callback, type);
+			} else {
+				app.addPopup(ProxyPopup, {uri: uri, callback: callback});
+			}
 		};
+		var post = $.post;
 		$.post = function (uri, data, callback, type) {
 			if (type === 'html') {
 				uri += '&testclient';
@@ -527,13 +541,19 @@ Storage.initTestClient = function () {
 			if (uri[0] === '/') { //relative URI
 				uri = Dex.resourcePrefix + uri.substr(1);
 			}
-			var src = '<!DOCTYPE html><html><body><form action="' + BattleLog.escapeHTML(uri) + '" method="POST">';
-			src += '<input type="hidden" name="testclient">';
-			for (var i in data) {
-				src += '<input type=hidden name="' + i + '" value="' + BattleLog.escapeHTML(data[i]) + '">';
+
+			if (sid) {
+				data.sid = sid;
+				post(uri, data, callback, type);
+			} else {
+				var src = '<!DOCTYPE html><html><body><form action="' + BattleLog.escapeHTML(uri) + '" method="POST">';
+				src += '<input type="hidden" name="testclient">';
+				for (var i in data) {
+					src += '<input type=hidden name="' + i + '" value="' + BattleLog.escapeHTML(data[i]) + '">';
+				}
+				src += '<input type=submit value="Please click this button first."></form></body></html>';
+				app.addPopup(ProxyPopup, {uri: "data:text/html;charset=UTF-8," + encodeURIComponent(src), callback: callback});
 			}
-			src += '<input type=submit value="Please click this button first."></form></body></html>';
-			app.addPopup(ProxyPopup, {uri: "data:text/html;charset=UTF-8," + encodeURIComponent(src), callback: callback});
 		};
 		Storage.whenPrefsLoaded.load();
 	});
diff --git a/testclient.html b/testclient.html
index 6fe0280ec..09a1456d5 100644
--- a/testclient.html
+++ b/testclient.html
@@ -71,6 +71,7 @@
 		<script src="js/lib/jquery-cookie.js"></script>
 		<script src="js/lib/autoresize.jquery.min.js"></script>
 		<script src="js/lib/soundmanager2-nodebug-jsmin.js"></script>
+		<script src="config/testclient-key.js"></script>
 		<script>
 			soundManager.setup({url: 'swf/'});
 		</script>