Network and proxies
Route a browser or a run through your own proxy or a platform proxy, keep the credential in the vault, and check the exit.
Modes
settings.network on a browser, or network on a run:
{ "mode": "direct" }{ "mode": "managed", "country": "us" }{ "mode": "custom", "server": "socks5://proxy.example:1080", "credential_id": "cred_…" }| Mode | Meaning |
|---|---|
direct | The server's own network; the default |
managed | A platform proxy with an exit in country — available only where the deployment has provisioned one (GET /v1/proxy-policy lists the countries) |
custom | Your proxy: HTTP, HTTPS or SOCKS5. No inline credentials, path or query in server; authentication comes from a vault credential |
A proxied Camoufox takes its language and time zone from the exit's GeoIP rather than the requested locale / timezone. A failed proxy launch never falls back to direct.
Proxy credentials
Owners and admins create a vault credential with kind: "proxy", an allowed_origins entry that matches the proxy server exactly, and a secret of {"username":"…","password":"…"}. The value is never returned. GET /v1/proxy-credentials lists the project's proxy credentials for readers and executors to select by id.
Changing, revoking or expiring a proxy credential stops the browsers using it with stop_reason: "credential_revoked"; requests already in flight may have reached the upstream.
Check the exit
POST /v1/browsers/{id}/network-test with {} (execute scope) checks the browser's actual egress without navigating the active page: ip, country (nullable), locale, timezone, latency_ms, measured_at. The same observation is kept on the browser as network_observation. Failure is network_test_failed; a browser an Agent run owns answers conflict. A requested country is not verified against geography.
Runs and sessions
A run takes the same network object. A new session keeps it for continuation; a continuation without network inherits it; a run on an existing browser must match the browser's route.
Traffic
The browser's final proxy_traffic.sent_bytes / received_bytes are counts at the local bridge — the meter Usage reports — not the supplier's billable figure.