Skip to main content
public preview

These docs are a public preview. The endpoint reference is still firming up as the API host is finalized.

Puppeteer connection guide

How Puppeteer connects to remote browsers.

Puppeteer's connect method attaches to existing browsers. It accepts a ConnectOptions object. browserWSEndpoint is a common remote attachment input.

The browser disconnect method detaches Puppeteer. It does not close the browser. Existing pages also remain open.

Legba's preview docs publish no Puppeteer WebSocket. They publish no CDP endpoint. Current Puppeteer compatibility remains undocumented.

Published byLegbaReviewed byAakash HarishSecurity Research Contributor, LegbaReviewed 2026-08-28 · Updated 2026-08-28

The short version

Attachment is simple. Ownership is not.

Remote Puppeteer requires an attachment contract.

Puppeteer usually launches a browser directly. Remote systems separate browser ownership from client ownership. A provider starts the browser process. Your application attaches through Puppeteer.

Puppeteer's connect method performs that attachment. It accepts a ConnectOptions object. The object can include browserWSEndpoint. That value identifies a running browser's WebSocket endpoint.

The browser wsEndpoint method returns this endpoint. Another Puppeteer client can use it. The endpoint follows a browser debugging WebSocket format. It is not an arbitrary viewing URL.

A successful connection proves attachment compatibility. It does not prove infrastructure cleanup. It also does not prove state isolation. Those contracts need separate evidence.

  • Identify the exact connection input.
  • Verify endpoint discovery and authentication.
  • Separate browser and client ownership.
  • Define context isolation behavior.
  • Define disconnect and close semantics.
  • Test provider resource termination.

SourcesGoogle PuppeteerGoogle PuppeteerGoogle PuppeteerGoogle Puppeteer

Legba's preview stops before Puppeteer attachment.

Legba labels its current API public preview. Its endpoint reference remains under refinement. The organization-specific API host is still finalizing. Production decisions should reflect that status.

Current docs describe REST instance lifecycle. Teams can create isolated browser instances. They can list active instances. They can destroy completed instances.

Instance responses include an access_url. The docs describe browser access through that value. They never define browserWSEndpoint compatibility. They never define any CDP endpoint.

Therefore, current Puppeteer compatibility is undocumented. The access_url cannot establish attachment semantics. Wait for an explicit connection contract. Recheck canonical docs before implementation.

Current Legba documentation supports limited conclusions.
FactorDocumented todayNot documented todayEngineering consequence
REST lifecycleCreate, list, and destroy instances.Puppeteer browser command transport.Evaluate lifecycle separately from attachment.
Instance accessResponses include an access_url.Access URL protocol semantics.Never derive browserWSEndpoint values.
REST authenticationBearer API-key authentication is documented.Browser-channel authentication requirements.Do not reuse assumptions across channels.
Puppeteer compatibilityNo current compatibility claim exists.WebSocket or browser URL inputs.Keep Puppeteer integration unimplemented.

Current Legba documentation supports limited conclusions.

SourcesLegbaLegbaLegbaLegbaGoogle Puppeteer

Choose the attachment input deliberately.

ConnectOptions supports several attachment inputs. browserWSEndpoint directly identifies a debugging socket. browserURL lets Puppeteer discover endpoint details. A custom transport supports specialized connections.

These inputs are not interchangeable strings. Each requires provider documentation. Authentication may use WebSocket headers. Network intermediaries may also affect connection behavior.

Local launch remains a different operating model. Puppeteer starts and owns that process. Remote attachment begins with an existing browser. Browser termination policy may belong elsewhere.

Legba currently documents none of these inputs. Its access_url has unspecified automation semantics. Do not convert or rewrite that field. Wait for published Puppeteer details.

An attachment matrix for Puppeteer remote browsers.
FactorConnection inputBest fitRequired proofMain tradeoff
browserWSEndpointDirect remote browser attachment.A documented debugging WebSocket URL.Any required headers or credentials.Endpoint lifecycle remains provider-specific.
browserURLHTTP-based endpoint discovery.A documented browser discovery URL.Reachable discovery and debugging interfaces.Discovery behavior adds another dependency.
Custom transportSpecialized connection implementations.A supported ConnectionTransport implementation.Clear ownership and error behavior.Custom code increases maintenance.
Local launchLocal runners and controlled hosts.Installed browser and runtime access.Application-owned process lifecycle.Compute remains application-managed.
REST instance accessProvider lifecycle and browser viewing.Exact documented access semantics.No implied Puppeteer compatibility.Attachment may require another contract.

An attachment matrix for Puppeteer remote browsers.

SourcesGoogle PuppeteerGoogle PuppeteerGoogle PuppeteerLegba

SourcesGoogle Puppeteer

Use a provider-neutral Puppeteer pattern.

The following pattern mirrors Puppeteer's documented connection. It deliberately uses a generic environment variable. Replace it only with provider documentation. Never transform an unrelated access URL.

The client attaches before creating a context. That context receives its own page. The example captures a simple screenshot. It closes context resources before disconnecting.

This example is provider-neutral. It uses a placeholder endpoint. It was not tested against Legba. It does not prove Legba compatibility.

Production code needs provider lifecycle handling. It also needs timeout and artifact policies. Those details depend on published contracts. Keep them outside generic attachment helpers.

  • Keep endpoints outside source code.
  • Use only documented connection inputs.
  • Create explicit browser contexts.
  • Close contexts before disconnecting.
  • Separate provider resource cleanup.
  • Never label this Legba-compatible.
Provider-neutral Puppeteer connection example.
import puppeteer from "puppeteer"

const browser = await puppeteer.connect({
  browserWSEndpoint: process.env.PUPPETEER_WS_ENDPOINT!,
})
const context = await browser.createBrowserContext()
const page = await context.newPage()

await page.goto("https://example.com")
await page.screenshot({ path: "page.png" })
await context.close()
browser.disconnect()

SourcesGoogle PuppeteerGoogle PuppeteerGoogle PuppeteerGoogle Puppeteer

Use contexts for explicit state boundaries.

Puppeteer browser contexts isolate browser storage. Separate contexts hold separate cookies. They also isolate local storage. Multiple contexts can share one browser process.

The default browser context has special behavior. It cannot be closed. Explicit contexts create clearer task ownership. Close each one after its assigned work.

Remote attachment may expose existing contexts. Inspect browserContexts after connection. Never assume the browser starts empty. Provider profiles may also preserve prior state.

State persistence remains provider-specific. Ask where profile data resides. Ask how long it remains. Ask how deletion works. Test isolation across consecutive tasks.

Context choices change isolation and cleanup.
FactorContext choiceOperational benefitRequired safeguard
Explicit contextCreates an isolated storage boundary.Clarifies task ownership.Close every context explicitly.
Default contextProvides the browser's existing session.May already contain pages.Inspect state before using it.
Existing remote contextMay preserve prior browser activity.Depends on remote browser ownership.Avoid assuming fresh storage.
Provider profileMay persist state across resources.Depends entirely on provider contracts.Verify retention and deletion behavior.

Context choices change isolation and cleanup.

SourcesGoogle PuppeteerGoogle PuppeteerLegba

Plan screenshots and artifacts intentionally.

Remote failures need visible evidence. A stack trace may miss page state. Screenshots capture a specific rendered moment. Puppeteer supports page and element screenshots.

The page screenshot method returns files or bytes. Screenshot options control output details. The calling application still owns storage. Provider filesystems may not persist afterward.

Screenshots can contain sensitive information. Login pages may expose identifiers. Account pages may expose personal data. Restrict retention and access appropriately.

Screenshots are only one diagnostic layer. Capture application logs and navigation errors. Record resource identifiers and timestamps. Test retrieval after an interrupted client.

  1. 01

    Choose required visual evidence.

    Define screenshot moments and output formats. Avoid excessive collection.

  2. 02

    Capture around failure boundaries.

    Record before risky steps. Capture again after failures.

  3. 03

    Persist evidence deliberately.

    Move outputs into approved storage. Verify retrieval after disconnection.

  4. 04

    Protect sensitive page content.

    Restrict access and retention. Delete artifacts when obligations end.

SourcesGoogle PuppeteerGoogle Puppeteer

Disconnect and close mean different things.

Puppeteer's disconnect method detaches the client. It does not shut down the browser. Existing pages remain open. Another client can reconnect afterward.

The browser close method closes all pages. It also closes the browser. That behavior differs from disconnect. Provider infrastructure may have another lifecycle. Confirm its termination contract separately.

Context closure provides narrower cleanup. It closes pages inside that context. Use context ownership for each task. Then choose disconnect or close deliberately.

Network failure can mimic an unplanned disconnect. Reconcile resources after client crashes. Use provider identifiers for lifecycle cleanup. Confirm termination through documented provider status.

Puppeteer cleanup actions affect different resources.
FactorActionWhat changesWhat may remain
Context closeCloses pages inside that context.Other contexts may continue.The browser process remains.
Browser disconnectDetaches the Puppeteer client.Browser and pages remain open.Provider resources may continue.
Browser closeCloses browser pages and process.Client attachment also ends.Provider records may still exist.
Provider terminationReleases provider-managed infrastructure.Uses the provider lifecycle contract.Application artifacts may remain separately.

Puppeteer cleanup actions affect different resources.

SourcesGoogle PuppeteerLegbaLegba

Prove the attachment contract before migration.

Begin with one production-shaped Puppeteer task. Include navigation and authentication. Include screenshots and expected outputs. Include a normal failure path.

Write attachment requirements before choosing providers. Name the accepted connection input. Name required Chromium features. Name acceptable network and timeout behavior.

Legba currently supports lifecycle research only. Its preview docs lack Puppeteer endpoint details. They also lack CDP endpoint details. Current evidence cannot justify implementation.

Return after published compatibility appears. Then test the exact documented endpoint. Exercise disconnect and provider termination separately. Recheck documentation before upgrades. Never publish guessed endpoints.

  1. 01

    Define the attachment input.

    Choose WebSocket, browser URL, or transport. Record required behavior.

  2. 02

    Require published provider evidence.

    Verify endpoint discovery, authentication, and ownership. Record remaining unknowns.

  3. 03

    Run one representative task.

    Exercise contexts, screenshots, downloads, and errors. Preserve useful evidence.

  4. 04

    Interrupt every lifecycle layer.

    Test network loss and client failure. Reconcile provider resources afterward.

  5. 05

    Review the current preview.

    Recheck canonical Legba documentation. Wait for explicit Puppeteer compatibility.

SourcesLegbaLegbaLegbaGoogle PuppeteerGoogle Puppeteer

FAQs.

References

  1. 01
  2. 02
  3. 03
  4. 04
  5. 05
  6. 06
  7. 07
    Puppeteer ConnectOptionsGoogle Puppeteer
  8. 08
  9. 09
  10. 10
    Puppeteer screenshotsGoogle Puppeteer

Keep exploring