Drive it over CDP

The sandbox browser speaks the Chrome DevTools Protocol. Point Playwright or Puppeteer at the browser’s CDP endpoint and your agent drives the same browser the live viewer shows - same tabs, same logins, same page.

The CDP endpoint is a WebSocket on api.miosa.ai:

wss://api.miosa.ai/api/v1/sandboxes/{id}/browser/cdp

It is control only. A view-only share token is refused here.

Get the endpoint

POST /browser starts the browser and returns cdp_url and stream_auth:

curl -X POST https://api.miosa.ai/api/v1/sandboxes/$SANDBOX_ID/browser 
  -H "Authorization: Bearer $MIOSA_API_KEY"

Authenticate the CDP socket

The socket takes the same credentials as the stream:

• ?token=<stream_auth> - the token returned by POST (1 hour). Simplest for an agent.
• Authorization: Bearer <msk_* API key> - API keys need the sandboxes:exec scope; a browser can reach anything the sandbox can, so the scope is deliberate.

Playwright

You can pass the token as a header instead of a query parameter when your client supports it, for example Playwright’s connect_over_cdp(cdp_url, headers={"Authorization": "Bearer " + api_key}).

Puppeteer

One browser, two drivers

Because the viewer and the agent share one browser:

• A person can open the live viewer while an agent is running and watch the agent work.
• If a person takes control, the agent’s next action lands on the same page.
• Cookies and logins persist across both, and across pause and resume of the sandbox.

Keep the agent and the human from acting at the same instant by taking control only when the automation is idle.

Close codes

If the socket closes before it is ready, the close code says why:

Next

• Live viewer - watch and take control.
• Limits, billing, security - lifecycle, billing, and how access is enforced.