Skip to content
Español Log inCreate account Menu

OpenWAF Browsers

Real Chrome for your AI agents, declared, not hidden.

OpenWAF Browsers runs Google Chrome in the EU for your AI agents. Open one with an API call, drive it with Playwright, Puppeteer or an MCP client, and watch it live. Its requests are signed with Web Bot Auth and go through an egress proxy that denies private addresses.

Open the dashboardRead the docs

Public beta | Free within quota

Web Bot Auth on by default

Hosted in Germany

One real session on production, 29 October 2026: the API answer (signed URLs shortened), the live view, the headers httpbin.org received, the 403 for 10.0.0.1 and the dashboard's egress log and usage for the same key.

How it works

From an API key to a page in Chrome

Your agent asks for a browser with one call and drives it over the Chrome DevTools Protocol.

  1. 1

    Ask for access

    Dashboard | Browsers

    An owner or admin asks from the dashboard and we approve the organization. Every owner and admin needs a verified e-mail and two-factor authentication.

  2. 2

    Create a key

    bdk_…

    An admin creates a key in the dashboard, the API, the CLI or MCP. The secret is shown once. Up to 5 keys per organization.

  3. 3

    Open a browser

    POST /v1/browsers

    One call with the key starts Chrome and returns its id, a CDP URL and a live view URL. The URLs expire after an hour; read the browser again for new ones.

  4. 4

    Drive it

    connectOverCDP

    Playwright, Puppeteer or Playwright MCP connect to the CDP URL. The browser stops when you stop it, after 2 minutes without a client or at 60 minutes.

Declared

An agent that says it is one

Sites decide what to let in. OpenWAF Browsers gives them what they need to decide: a real browser and a signed identity.

What it does

  • Runs Google Chrome as Google ships it, with a window (headful). No patched or stealth build.
  • Signs its requests with Web Bot Auth by default. Sites check the signature against the key directory at browsers.openwaf.dev/.well-known/http-message-signatures-directory.
  • Leaves Chrome’s fingerprint alone: a site sees the browser that is really there.
  • Runs on our servers in Germany, and its traffic leaves from there.

What it will not do

  • Spoof fingerprints or hide that it is automated
  • Route traffic through residential or per-country proxies
  • Solve CAPTCHAs or other checks meant for people
  • Pass an agent off as a person

An admin can turn Web Bot Auth off for the organization. That does not allow impersonating people: the acceptable use addendum still applies.

Egress proxy

Every request goes through a filter

The browsers have no direct route to the internet. Each request passes a proxy that checks it and logs it.

  • Private addresses always denied

    Loopback, RFC 1918, link-local (including 169.254.169.254), CGNAT and other special-purpose addresses are refused in every mode.

  • Web ports only

    Ports 80 and 443. Any other port is refused.

  • Open or allowlist

    In open mode any public host is allowed. In allowlist mode only the hosts you list: example.com for one host, *.example.com for its subdomains, up to 100 entries.

  • A log of every request

    Time, key, session, method, host, port, decision, status, bytes and duration, in the dashboard, the API, the CLI and MCP. A denied request carries its reason.

Sessions

Watch it live, look back later

What a browser does is visible while it runs and kept for a week after.

  • Live view

    Each browser comes with a live view URL. The dashboard lists running sessions with a view-only link.

  • Recordings

    Start a browser with "recording": true. Its files are kept for 7 days and listed at GET /v1/browsers/{id}/files.

  • Profiles

    Named profiles keep a browser’s state between sessions. A profile cannot be changed or deleted while a browser uses it.

  • Session limits

    A browser stops when you stop it, after 120 seconds without a client, or at 60 minutes. keepAlive and timeout change the idle rule.

  • Viewport, language and metadata

    Set viewport and lang per browser, and up to 10 metadata pairs to find sessions later.

  • Hosted in the EU

    The browsers run on our servers in Germany, where the rest of OpenWAF’s data is.

Public beta

Free within the quota

Subject to approval. These are the default limits per organization; we can adjust them.

  • 20 hof browser time a month
  • 5 GBof egress a month, upload and download
  • 2browsers at a time per key

Sessions last up to 60 minutes and an organization can have up to 5 keys. The month is the calendar month in UTC. The dashboard warns at 80 % of either quota. At 100 % every key of the organization pauses, and running sessions stop, until 00:00 UTC on the 1st. Capacity is shared during the beta: when it is full, POST /v1/browsers answers 429 capacity_busy with Retry-After: 30.

Quickstart

A page in Chrome in two steps

Create a key in the dashboard, then open a browser and connect to it.

  1. 1

    Open a browser

    One call with your key. Every field of the body is optional.

    $ curl -s https://browsers.openwaf.dev/v1/browsers \
    -H "X-API-Key: $BROWSERS_KEY" \
    --json '{"recording": true}'
{"id": "bs_…",
 "cdpUrl": "wss://browsers.openwaf.dev/cdp/…",
 "liveUrl": "…", …}
  2. 2

    Connect with Playwright

    Puppeteer works the same way: puppeteer.connect({browserWSEndpoint: b.cdpUrl}).

    import { chromium } from "playwright";

// b: the JSON that POST /v1/browsers returned
const browser = await chromium.connectOverCDP(b.cdpUrl);
const page = await browser.contexts()[0].newPage();
await page.goto("https://example.com/");

For an MCP client, run npx @playwright/mcp@latest --cdp-endpoint <cdpUrl>. Next: the quickstart, the API, CLI and MCP reference and the limits.

Rules of use

What it is not for

What agents may not do with the browsers. We may suspend a key or an organization without notice for abuse.

Not allowed

  • Credential stuffing, account takeover, or logging in to accounts you may not use
  • Getting around logins, paywalls, rate limits or CAPTCHAs
  • Creating accounts in bulk, or fake reviews, votes, clicks and followers
  • Scraping that a site’s terms or its robots.txt forbid
  • Spam, fraud, phishing, malware or illegal content
  • Attacking or scanning other people’s systems

The full rules are in the acceptable use addendum, pending legal review. Report abuse to abuse@openwaf.dev.

Links

FAQ

OpenWAF Browsers questions

Can it get past bot protection?

That is not what it is for. It does not spoof fingerprints, use residential proxies or solve CAPTCHAs, and it signs its requests with Web Bot Auth so sites can tell it is an agent. If a site blocks agents, it stays blocked.

Which browser is it?

Google Chrome as Google ships it, headful, on our servers in Germany. You drive it over the Chrome DevTools Protocol with Playwright, Puppeteer or any CDP client.

How do I get access?

Ask from the Browsers section of the dashboard, or write to support@openwaf.dev with your organization id. We approve organizations one by one. Every owner and admin needs a verified e-mail and two-factor authentication.

What does it cost?

Nothing during the public beta, within the quota: 20 browser-hours and 5 GB of egress a month per organization. Past the quota the keys pause until the next month. Nothing is charged.

Can I turn off Web Bot Auth?

Yes, an admin can, for the whole organization. It does not allow passing the agent off as a person: the acceptable use addendum still applies.

What happens when every browser is busy?

POST /v1/browsers answers 429 with the code capacity_busy and Retry-After: 30. A key that already runs 2 browsers gets 429 key_concurrency.

Give your agents a browser that says who it is.

OpenWAF Browsers is in public beta: free within the quota, subject to approval. Ask for access from the dashboard.

Open the dashboardRead the docs