Protected requests
Plan for targets that require browser workflows or anti-bot handling.
Use browser or residential_browser when a target needs JavaScript execution, cookies, or a browser workflow. Protected-request behavior varies by target and deployment; leave room for a request to fail rather than assuming a browser route guarantees access.
Do not send credentials or secrets in a URL unless the target contract explicitly requires it. Redact protected data from logs and support tickets.
TODO(PRODUCT_INPUT_REQUIRED): document the authoritative protected-request and CAPTCHA policy when product owners publish it.
Last updated on