Internal Agents

Browserbase describes keeping its internal agent's service credentials outside the environment where the agent executes code. In its architecture account, most integrations run through a proxy that holds the credentials and checks whether a session may call a particular service operation. The sandbox receives short-lived access credentials instead.

Permissions then determine what that access permits. Background tasks receive restricted scopes when launched, while interactive sessions have broader access. This separates two concerns: preventing the agent from reading a service's underlying key, and limiting which actions it can request. The proxy enforces those action limits outside the model. Browserbase itself says this is not a complete defense, because an agent can still generate arbitrary web requests, so it adds request interception and domain allowlisting for sensitive internal APIs.