Secure Playwright Browser Automation Runner

Run secure, declarative Playwright browser workflows for AI agents and backend automation — without arbitrary user JavaScript or Python.

Navigate · Click · Fill · Extract · Assert · Screenshot

• SSRF-protected network access
• Bounded runtime and resource usage
• Structured per-action audit trail
• Deterministic selector targeting
• Failed browser actions are not charged as browser actions
• $4 per 1,000 successfully completed browser actions

Production-like cloud validation matched expected behavior in 422/423 runs (99.76%), including 54/54 security cases.

Quick start

{
  "startUrl": "https://example.com",
  "actions": [
    {"type": "getTitle"},
    {"type": "extractText", "selector": "h1"}
  ]
}

Each run produces one structured dataset result with execution status, action results, timing, security/network counters, and billing information.

What it does

Start from a public HTTP(S) URL and execute up to 100 declarative browser actions:

• goto
• waitForSelector
• click
• fill
• select
• extractText
• extractAttribute
• getTitle
• getUrl
• assertText
• screenshot
• wait

Each run writes one structured result to the default dataset with the final status, per-action audit trail, timing, network/security counters, and billing information.

Pricing

Primary billing event: Browser action.

• $0.004 per successfully completed browser action — $4 per 1,000 successful actions.
• Failed actions are not charged as browser actions.
• Initial startUrl navigation is not counted as a browser action.
• The runner checks the run spending limit before starting the next billable action and stops when the limit is reached.

Apify may also apply its small standard Actor-start charge shown in the run pricing details.

Example input

{
  "clientReference": "agent-job:abc-123",
  "startUrl": "https://example.com",
  "stopOnError": true,
  "maxRunSeconds": 120,
  "actions": [
    {"type": "getTitle"},
    {"type": "waitForSelector", "selector": "h1", "timeoutSeconds": 10},
    {"type": "extractText", "selector": "h1"},
    {"type": "screenshot", "key": "page-shot", "fullPage": true}
  ]
}

Ambiguous selectors

Playwright strict selector behavior is preserved by default. If a selector intentionally matches multiple elements, choose a specific zero-based match with matchIndex:

{
  "type": "extractText",
  "selector": "span.titleline > a",
  "matchIndex": 0
}

matchIndex is bounded from 0 to 999.

Output

The dataset result includes fields such as:

• runnerVersion
• clientReference
• passed
• startUrl / finalUrl
• actionsRequested
• actionsExecuted
• browserActionsCompleted
• billingMode
• browserActionsCharged
• chargeLimitReached
• elapsedMs
• network/security counters
• per-action results and errors

Screenshots are stored as run artifacts and referenced from the action result.

Security model

This Actor intentionally does not expose arbitrary user-supplied JavaScript or Python execution.

Network and execution boundaries include:

• public HTTP(S) destinations only;
• ports 80 and 443 only;
• private, loopback, link-local, reserved, and mixed public/private DNS destinations rejected;
• URL credentials rejected;
• DNS resolution checked before connecting and the proxy connects to the checked public IP;
• Chromium proxy bypass disabled for loopback destinations;
• WebSockets blocked;
• downloads blocked;
• service workers blocked;
• uncontrolled popups closed;
• non-proxied WebRTC/WebTransport restricted;
• QUIC disabled;
• maximum 300 proxied browser connections per run;
• maximum 64 MiB aggregate browser network transfer per run;
• maximum 100 actions;
• maximum 60 seconds per action;
• maximum 180 seconds per workflow;
• extracted string output capped at 200,000 characters per action;
• screenshot artifacts capped at 8 MiB;
• unknown input and action fields rejected.

These controls reduce SSRF, runaway-resource, and accidental high-cost risks, but they do not make arbitrary third-party automation authorized. Only automate websites and systems you are permitted to access.

Reliability

Before public launch, the runtime completed a balanced 423-run production-like cloud test across navigation, forms, interaction, dynamic pages, screenshots, controlled failures, selector ambiguity, edge cases, and security cases. Expected behavior matched 422/423 runs (99.76%); all 54 security cases behaved as expected.

External websites can still change, throttle requests, or become unavailable. Use explicit selectors and appropriate timeouts for production workflows.

Supported scope

Good fit:

• deterministic AI-agent browser tools;
• backend browser workflows;
• form and UI automation on authorized targets;
• extraction from dynamic pages;
• bounded QA and smoke tests;
• auditable browser steps.

Not supported by design:

• arbitrary JavaScript/Python execution;
• CAPTCHA bypass;
• private-network access;
• credential theft or unauthorized account access;
• browser extensions;
• residential-proxy scraping workflows;
• WebSocket-dependent applications;
• unrestricted browser control.

Notes

clientReference can be used to correlate a run with an external job ID without putting secrets into the input. Do not include passwords, API keys, session cookies, or other secrets unless you have an appropriate secret-management path and are authorized to use them.