Complete reference for all Antybrowser API endpoints. Use these to manage profiles, proxies, groups, extensions, settings, and user accounts programmatically.
All endpoints require authentication. Pass a Bearer token via the Authorization header (used by the Electron app), or include the auth_token HTTP-only cookie (used by the web dashboard).
Get a token by calling POST /api/login or POST /api/register.
https://antybrowser.comAll endpoints are relative to this base URL. For local development, use http://localhost:5001.
Login, register, and manage your session.
/api/loginAuthenticate with email and password. Returns a JWT token and sets an HTTP-only cookie. If 2FA is enabled, returns `{ requires2FA: true, tempUserId }` instead.
Request Body
{
"email": "user@example.com",
"password": "secret123",
"twoFactorCode": "123456" // optional, required if 2FA enabled
}Response
{
"id": 1,
"name": "John",
"email": "user@example.com",
"plan": "free",
"_token": "eyJhbGciOi..."
}/api/registerCreate a new account.
Request Body
{
"name": "John",
"email": "user@example.com",
"password": "secret123"
}Response
{
"id": 1,
"name": "John",
"email": "user@example.com",
"plan": "free",
"_token": "eyJhbGciOi..."
}/api/auth/recoverSends a password reset email to the given address.
Request Body
{
"email": "user@example.com"
}Response
{
"message": "If an account exists, a reset link has been sent."
}/api/auth/reset-passwordResets the user's password using a valid reset token.
Request Body
{
"token": "abc123...",
"password": "newpass123"
}Response
{
"message": "Password reset successful"
}Get, update, or delete the authenticated user.
/api/userReturns the authenticated user's profile. Accepts Bearer token (Electron) or auth_token cookie (web).
Response
{
"id": 1,
"name": "John",
"email": "user@example.com",
"plan": "free",
"googleId": null,
"microsoftId": null,
"twoFactorEnabled": false,
"newsletterSubscribed": true,
"createdAt": "2025-01-15T..."
}/api/userUpdate name, password, newsletter preference, messaging, or 2FA settings.
Request Body
{
"name": "New Name",
"password": "newpass",
"newsletterSubscribed": true,
"messagingApp": "telegram",
"messagingHandle": "@username",
"twoFactorEnabled": true
}Response
{
"id": 1,
"name": "New Name",
"email": "user@example.com",
"plan": "free"
}/api/userPermanently deletes the authenticated user and all associated data.
Response
(204 No Content)
Set up, verify, and disable TOTP-based 2FA.
/api/user/2fa/setupGenerates a new TOTP secret and provisioning URI. The secret is stored temporarily ΓÇö call verify to activate.
Response
{
"secret": "JBSWY3DPEHPK3PXP",
"uri": "otpauth://totp/Antybrowser:user@example.com?..."
}/api/user/2fa/verifyVerifies a TOTP code and enables 2FA for the account. Must call setup first.
Request Body
{
"code": "123456"
}Response
{
"message": "2FA enabled successfully"
}/api/user/2fa/disableDisables 2FA after verifying a valid TOTP code. Clears the stored secret.
Request Body
{
"code": "123456"
}Response
{
"message": "2FA disabled successfully"
}/api/user/2fa/validateValidates a TOTP code during login. Returns user data on success.
Request Body
{
"userId": 1,
"code": "123456"
}Response
{
"id": 1,
"name": "John",
"email": "user@example.com"
}Link and unlink Google / Microsoft accounts.
/api/user/link/googleRedirects to Google OAuth. After authorization, the Google account is linked to the current user. Must be logged in (cookie required).
Response
(302 Redirect to Google OAuth)
/api/user/link/microsoftRedirects to Microsoft OAuth. After authorization, the Microsoft account is linked to the current user.
Response
(302 Redirect to Microsoft OAuth)
/api/user/linkRemoves a linked provider. Refuses if it's the only login method (no password and no other provider linked).
Request Body
{
"provider": "google" // or "microsoft"
}Response
{
"id": 1,
"name": "John",
"googleId": null,
"microsoftId": "ms-uuid-..."
}Create, update, launch, and manage browser profiles.
/api/profilesReturns all profiles for the authenticated user.
Response
[
{
"id": 1,
"name": "My Profile",
"browserType": "Chrome",
"osFingerprint": "Windows",
"status": "Idle",
"proxyId": null,
"groupId": null
}
]/api/profiles/:idReturns a single profile by ID.
Response
{
"id": 1,
"name": "My Profile",
"browserType": "Chrome",
"screenResolution": "1920x1080",
"language": "en-US",
"timezone": "America/New_York"
}/api/profilesCreates a new browser profile.
Request Body
{
"name": "My Profile",
"browserType": "Chrome",
"osFingerprint": "Windows",
"screenResolution": "1920x1080",
"language": "en-US",
"timezone": "America/New_York",
"groupId": null,
"proxyId": null
}Response
{
"id": 1,
"name": "My Profile",
"status": "Idle",
"createdAt": "2025-01-15T..."
}/api/profiles/:idUpdates an existing profile. Only provided fields are changed.
Request Body
{
"name": "Renamed Profile",
"proxyId": 5,
"notes": "Updated notes"
}Response
{
"id": 1,
"name": "Renamed Profile",
"proxyId": 5
}/api/profiles/:idMoves a profile to trash (soft delete).
Response
{
"message": "Profile moved to trash",
"profile": { "id": 1, "trash": true }
}/api/profiles/:id/restoreRestores a trashed profile.
Response
{
"id": 1,
"name": "My Profile",
"trash": false
}/api/profiles/trashReturns all profiles in trash.
Response
[
{ "id": 1, "name": "Old Profile", "trash": true }
]/api/profiles/trashPermanently deletes all trashed profiles.
Response
{
"deleted": 3,
"message": "3 profiles permanently deleted"
}/api/profiles/:id/launchStarts a browser instance for the given profile.
Response
{
"message": "Profile launched",
"status": "Running"
}/api/profiles/:id/randomizeGenerates new random fingerprint data for the profile.
Response
{
"id": 1,
"osFingerprint": "macOS",
"screenResolution": "1440x900"
}/api/profiles/:id/historyReturns the event history for a profile.
Response
[
{
"id": 1,
"profileId": 1,
"type": "launch",
"description": "Profile launched",
"createdAt": "2025-01-15T..."
}
]/api/profiles/:id/historyAdds a custom entry to the profile's history.
Request Body
{
"type": "custom",
"description": "Manually added note",
"data": { "key": "value" }
}Response
{ "success": true }Organize profiles into named groups.
/api/groupsReturns all groups for the authenticated user.
Response
[
{
"id": 1,
"name": "Social Media",
"color": "blue",
"displayOrder": 0
}
]/api/groupsCreates a new profile group.
Request Body
{
"name": "Social Media",
"description": "Social media accounts",
"color": "blue"
}Response
{
"id": 1,
"name": "Social Media",
"color": "blue"
}/api/groups/:idUpdates a group's name, description, or color.
Request Body
{
"name": "Renamed Group",
"color": "red"
}Response
{
"id": 1,
"name": "Renamed Group",
"color": "red"
}/api/groups/:idDeletes a group. Profiles in the group are not deleted.
Response
(204 No Content)
/api/groups/reorderSets the display order of groups by providing an ordered array of IDs.
Request Body
{
"ids": [3, 1, 2]
}Response
{ "success": true }Manage proxy servers for profiles.
/api/proxiesReturns all proxies for the authenticated user.
Response
[
{
"id": 1,
"name": "US Residential",
"type": "http",
"host": "proxy.example.com",
"port": 8080,
"status": "active",
"country": "United States",
"ip": "1.2.3.4"
}
]/api/proxies/:idReturns a single proxy by ID.
Response
{
"id": 1,
"name": "US Residential",
"type": "socks5",
"host": "proxy.example.com",
"port": 1080,
"username": "user",
"status": "active"
}/api/proxiesAdds a new proxy.
Request Body
{
"name": "US Residential",
"type": "http",
"host": "proxy.example.com",
"port": 8080,
"username": "user",
"password": "pass"
}Response
{
"id": 1,
"name": "US Residential",
"status": "active"
}/api/proxies/:idUpdates a proxy's configuration.
Request Body
{
"name": "Renamed Proxy",
"host": "new-proxy.example.com"
}Response
{
"id": 1,
"name": "Renamed Proxy",
"host": "new-proxy.example.com"
}/api/proxies/:idPermanently deletes a proxy.
Response
(204 No Content)
/api/proxies/:id/save-checkSaves the result of a proxy connectivity check.
Request Body
{
"success": true,
"details": {
"ip": "1.2.3.4",
"country": "United States",
"isp": "Comcast"
}
}Response
{
"id": 1,
"status": "active",
"ip": "1.2.3.4"
}Manage saved proxy provider credentials.
/api/proxy-providersReturns all saved proxy providers.
Response
[
{
"id": 1,
"provider": "brightdata",
"username": "user",
"countryCode": "US"
}
]/api/proxy-providers/:providerReturns credentials for a specific provider.
Response
{
"id": 1,
"provider": "brightdata",
"username": "user",
"password": "***",
"countryCode": "US"
}/api/proxy-providers/:providerCreates or updates proxy provider credentials (upsert).
Request Body
{
"username": "myuser",
"password": "mypass",
"countryCode": "US"
}Response
{
"id": 1,
"provider": "brightdata",
"username": "myuser"
}Manage browser extensions.
/api/extensionsReturns all extensions.
Response
[
{
"id": 1,
"name": "AdBlock",
"description": "Blocks ads",
"version": "5.0.0"
}
]/api/extensionsAdds a new extension.
Request Body
{
"name": "AdBlock",
"description": "Blocks ads",
"icon": "shield"
}Response
{
"id": 1,
"name": "AdBlock"
}/api/extensions/:idPermanently deletes an extension.
Response
(204 No Content)
Read and update application settings.
/api/settingsReturns the current user's application settings.
Response
{
"chromePath": "C:\\Program Files\\Google\\Chrome\\chrome.exe",
"defaultBrowserType": "Chrome",
"defaultOsFingerprint": "Windows",
"defaultScreenResolution": "1920x1080",
"defaultLanguage": "en-US",
"hardwareAcceleration": true,
"lowBandwidth": false
}/api/settingsUpdates application settings. Only provided fields are changed.
Request Body
{
"defaultBrowserType": "Chrome",
"defaultScreenResolution": "1440x900",
"hardwareAcceleration": false
}Response
{
"defaultBrowserType": "Chrome",
"defaultScreenResolution": "1440x900",
"hardwareAcceleration": false
}Manage browser user-agent versions.
/api/user-agents/versionsReturns all stored user-agent brand/version pairs.
Response
[
{ "id": 1, "brand": "Chrome", "version": "131.0.6778.86" },
{ "id": 2, "brand": "Firefox", "version": "133.0" }
]/api/user-agents/versionsCreates or updates a user-agent brand/version entry.
Request Body
{
"brand": "Chrome",
"version": "131.0.6778.86"
}Response
{
"id": 1,
"brand": "Chrome",
"version": "131.0.6778.86"
}API endpoints are rate-limited to prevent abuse. If you receive a 429 Too Many Requests response, wait before retrying. The login endpoint has additional protection against brute-force attacks.