Stealth mode
Stealth sessions run a real, current Chrome on Linux and give every session its own plausible fingerprint — no spoofed operating systems, no prototype patches that detectors fingerprint on sight. Available on every plan, including Free.
Enable it
{ "stealth": true, "fingerprint": { // optional; anything unset is randomised per session "screen": { "width": 1920, "height": 1080 }, "hardware_concurrency": 8, "device_memory": 8 }}The profile that was applied comes back in config.fingerprint on the session object (screen, cores, memory, plus the timezone and locale derived from the proxy exit country when you did not set them), so a run is reproducible if you need it to be.
What a stealth session does
| Layer | Behaviour |
|---|---|
| Browser | Pinned Chrome for Testing (x64) on Debian with real fonts and SwiftShader WebGL — an honest Linux Chrome, never a claimed Windows or macOS. |
| Fingerprint | Per-session screen size from a table of common desktop resolutions (the display itself is that size — not just a reported value), hardware concurrency, device memory, timezone, locale, and geolocation, all coherent with each other and with the proxy exit. |
| User agent | Full User-Agent Client Hints metadata (brands, platform Linux, architecture x86, bitness 64) matching the pinned Chrome major. A custom user_agent must be a Chrome UA of the same major on Linux x86_64 or the create is a 400. |
| Automation tells | Playwright/Puppeteer isolated-world names are rewritten, sourceURL markers are stripped from evaluated scripts, and no legacy prototype patches are injected (those are what detectors look for). |
| Recording | Stealth sessions do not enable the Console/Runtime DevTools domains for the replay recorder unless you pass record_console: true — enabling them is itself a detectable signal. |
Connect with Patchright
Stock Playwright and Puppeteer call Runtime.enable on every page, which is the single most reliable automation tell in 2026 — and one we deliberately do not intercept, because proxying it breaks the client. Use Patchright (a drop-in Playwright fork that avoids it) for stealth sessions:
import { chromium } from "patchright"; // npm i patchright (or: pip install patchright) const browser = await chromium.connectOverCDP(session.cdp_url, { headers: { "x-session-token": session.cdp_token },});const page = browser.contexts()[0].pages()[0];await page.goto("https://example.com");- Prefer
connectOverCDPoverconnect: it attaches to the existing browser context (with the session's fingerprint, cookies, and proxy) instead of creating a new one. - Avoid
page.addInitScriptandpage.evaluatein hot paths where you can; drive the page with real input events. - Pair stealth with a residential proxy — a clean browser on a datacenter IP still scores low with reCAPTCHA v3.