Octo Browser 3.2: new API features

Separate permissions for API tokens

Previously, the team had a single API token with master account permissions. Anyone who had it could manage the entire account: profiles, actions, folders, tags, and the team, regardless of the permissions assigned to them in the browser interface.

Now you can create multiple tokens and configure permissions separately for each one. Token management has its own section in the account settings called “API tokens.”

When creating a token, you specify its name and permissions using the same categories as those available to team members in the “Team” section: profile access, action access, plus separate toggles for managing folders, tags, the team, and the action log.

After creation, the token is displayed only once. Copy and save it before closing the window. If you lose it, you won’t be able to use the old token, but you can immediately generate a new one with the same permissions.

You can change permissions at any time without regenerating the token. If you need to regenerate a token, the old one stops working as soon as the new one is generated. Its permissions remain unchanged, so you only need to update the key in your integrations.

Everything done via the API is now recorded in the action log. To see what a specific token has been used for, filter the log by its name, just as you would for a team member. Token creation, deletion, and regeneration, as well as changes to token permissions, are also recorded in the action log.

The ability to issue tokens with specific sets of permissions is available with the Team and Advanced subscriptions. You can create up to 3 tokens on Team and up to 5 on Advanced. All team tokens share the same request limit. Splitting integrations across different tokens does not increase the limit—it remains the same for the entire team. Tokens issued before the update will continue to work. They will appear in the list as “API Token” with a full set of permissions.

Protection against profile deletion via API

A profile can be deleted with a single API request, whether the request is intentional or caused by an accidental error in a script. Now that you can have multiple tokens, there’s another reason to keep important profiles protected.

Profiles now have a “Protect against deletion via API” setting (“Profile settings” → “General” → “Additional Settings”). When it is enabled, the profile cannot be deleted via API. Deletion remains available through the browser interface.

The setting is also available in profile templates, so you can create new profiles with this protection enabled from the start.

Proxy Shop via API

Previously, proxies purchased in Octo could only be managed through the browser interface. Now you can also manage them via API: view the proxy list for each provider, create proxies, edit their names, delete proxies, and check which geolocations a provider offers.

We’ve also added the ability to check the traffic balance.

Other improvements and fixes

• Added a “Real” mode for media devices: the profile will use the real cameras, microphones, and speakers of your device.

• The screen resolution list now includes scale, color depth, and P3 values. This gives you even more precise control over each profile's screen settings.

• New API endpoints: a list of supported operating systems and their versions, subscription information, working with the Trash bin, and proxy checking.

• The local HTTP server port can now be changed through an environment variable when launching the browser, without having to use the interface.