Authentication & keys
Workspace-scoped access for applications, agents, and browser viewers.
Authenticate each request
REST requests use a Tabfleet API key in the Authorization header. MCP supports OAuth access tokens or API keys. API keys start with abc_. The health endpoint is public.
Authorization: Bearer YOUR_TABFLEET_API_KEYChoose a key permission
| Capability | Browser control | Read only |
|---|---|---|
| List sessions and usage | Yes | Yes |
| Read snapshots and screenshots | Yes | Yes |
| Mint view-only signed links | Yes | Yes |
| Launch or close browsers | Yes | No |
| Navigate, click, fill, or connect CDP | Yes | No |
| Mint interactive viewer links | Yes | No |
| Revoke viewer links or change embedding origins | Yes | No |
Create, rotate, and revoke
Manage keys in the dashboard. Each workspace may have up to 10 active keys. Use a dedicated key per client so you can revoke one integration without disrupting the rest.
To rotate, create a replacement, update the client, verify its connection, then revoke the old key. Only key hashes are retained by Tabfleet.
Revocation blocks future authenticated requests and new connections. Existing signed standalone streams are checked within the normal 30-second cleanup cycle. For immediate viewer removal, revoke the session’s signed links. To stop an existing external controller, close its browser session.
API keys and signed links are different
A workspace API key can access sessions in its workspace. A CDP connection URL is scoped to one session and exposes browser control. A signed standalone viewer URL grants only its specified view or control permission for one session.
A signed viewer link needs no Google sign-in. Anyone holding it can use it until expiration or revocation. Keep it out of analytics, logs, public repositories, and persistent public HTML.
The authenticated dashboard links returned by launch_browser contain only a session ID. Those links still require access to the owning workspace.
Call the API from your backend
The browser API permits cross-origin dashboard requests only from Tabfleet’s configured dashboard origins. Customer websites should call their own backend; that backend holds the workspace key and calls Tabfleet. Pass only a short-lived viewer URL to the frontend.
Google sign-in authenticates the Tabfleet account. OAuth-capable MCP clients discover Tabfleet’s authorization server, open a consent screen, and receive Tabfleet access tokens after approval. Google tokens, account cookies, and query-string keys do not authenticate MCP. See auth.md for endpoints and permissions.