# Anti-detect browser local API explained > An anti-detect browser local API is an HTTP server on 127.0.0.1 that creates, starts and stops profiles and hands your script a DevTools endpoint. Source: https://mosaicbrowser.com/guides/anti-detect-browser-local-api ## Anti-detect browser local API: what it is and what to check An anti-detect browser local API is an HTTP server the app runs on your own computer, usually on 127.0.0.1, that lets a script create, start, stop and edit profiles. Its most useful answer is the DevTools endpoint a start returns, which Playwright or Puppeteer attach to. ![181: Routes in Mosaic's local API, as of 2 November 2026, beside a screenshot: mosaic API keys: one per script or tool, each revocable on its own](https://mosaicbrowser.com/covers/anti-detect-browser-local-api.webp) An anti-detect browser is an app that manages many browser profiles, and its local API is the same app answering HTTP instead of clicks. It listens on a port on your own machine. A script sends `POST /profiles` to make a profile and `POST /profiles/:id/start` to open it, and gets back the address of the browser's DevTools socket. From there the script drives the page with Playwright, Puppeteer or raw DevTools Protocol messages, and the profile's fingerprint, proxy and cookies are already in place because the app launched it. ## Why an anti-detect browser local API is local The profiles live on the computer, so the browsers start there, and an API that starts them has to run there too. That is a security boundary as much as a convenience. A server bound to `127.0.0.1` cannot be reached from the network, only by programs on the same machine. Mosaic's runs at `http://127.0.0.1:7317/api/v1` by default, as the [REST API page](https://mosaicbrowser.com/features/rest-api) describes. It is a desktop app with a local API, not something you deploy: there is no Docker image and no cloud endpoint. Mosaic is a desktop app Email yourself the link and open it on your computer. [How it works: REST API](https://mosaicbrowser.com/features/rest-api) ## What a good local API answers Before building on any local API, these are the questions we would put to it, Mosaic's included. ### Does starting a profile give you a DevTools endpoint? This is the whole automation story. A start that returns `wsEndpoint` (or a debugging port) lets any CDP library attach. Mosaic's start returns `{ profileId, status, pid, debugPort, wsEndpoint, cdpUrl, startedAt, error }`; the [Playwright guide](https://mosaicbrowser.com/guides/use-playwright-with-an-anti-detect-browser) shows the attach step. ### Does it refuse to start behind a dead proxy? Chromium falls back to a direct connection for anything its proxy refuses. A launch that goes ahead anyway gives you a window that works, pages that load, and an identity browsing from your own address, with nothing in the response to say so. Mosaic checks the proxy before the browser opens; if the proxy has not answered and tunnelled, the start is a `502` naming the proxy and quoting what it said. ### Does a batch tell you which ones failed? "Started 40" over eight failures is not an answer. Mosaic's bulk routes return `{ ok, skipped, failures }`, and each failure carries the profile id and the reason. ### Does it refuse a bad field, or quietly drop it? A misspelled field and a stored one look identical from outside. Mosaic refuses an unknown key with a `400` naming it, and refuses an out-of-range value instead of clamping it: `"count": 9000` on a create is an error, not a quiet batch of 500. A `4xx` message is written for the caller. A `500` means the bug is ours. ### Can the API do everything the window can? If the screen can rename a tag and the API cannot, a script hits a wall halfway through a job. Mosaic holds the window, the REST API and the [MCP server](https://mosaicbrowser.com/features/mcp-server) as peers, and the build runs a check that maps every REST route to the MCP tool that does the same job. When that check first ran there were 175 routes against 122 tools, with whole areas missing on one side. As of 2 November 2026 there are 181 routes and 156 tools, and every route maps to a tool or carries the reason it cannot exist on a tool surface. ![The Mosaic API screen with three named API keys](https://mosaicbrowser.com/shots/api-keys.png) *API › Keys: one key per script, revocable on its own* ## Keys, and what a key can reach Any program on the computer can open a connection to `127.0.0.1`, so a local API without a key is open to every process you run. Mosaic needs `Authorization: Bearer ` on every route except `GET /health`, which exists so a supervisor can check the app is up without holding a credential. Keys are made on the API screen, shown once, and stored as a hash. A key reaches the whole library, so give each script its own and revoke the one you no longer need. The API activity screen shows which key is calling right now. Destructive routes work the other way round from edits. An absent field on an edit leaves the value alone; an absent scope on something irreversible, such as emptying the trash, is a `400`, never "all of it". ## A first call ``` KEY=msc_… BASE=http://127.0.0.1:7317/api/v1 # A profile in the system project, fingerprint drawn fresh, proxy attached to it alone curl -X POST -H "Authorization: Bearer $KEY" -H 'content-type: application/json' \ -d '{"name":"Shop - Berlin 01","proxy":"user:pass@gw.provider.com:9000"}' \ "$BASE/profiles" # Start it, and print the socket to attach to curl -X POST -H "Authorization: Bearer $KEY" "$BASE/profiles/$ID/start" | jq -r .wsEndpoint ``` The response to the first call carries `exitMatch`, which says whether the profile's timezone and language were drawn from the proxy's measured exit, and why not if they were not. For scripts that run many profiles, the [guide to automating several profiles](https://mosaicbrowser.com/guides/automate-multiple-browser-profiles) covers batches and staggered starts. The local API is part of Pro, $49 a month with a 14-day free trial, on the [pricing page](https://mosaicbrowser.com/pricing). ## Questions ### Why is the API local instead of in the cloud? Because the browsers run on your computer. A local API starts them where they live, and nothing about your profiles has to pass through a server to do it. Mosaic's binds 127.0.0.1, so only programs on the same machine can reach it. ### Does a local API need a key? It should. Any program on the computer can open a connection to 127.0.0.1, including a page in another browser. Mosaic requires a key on every route except GET /health. ### Can I call Mosaic's API from a server or another computer? No. It answers on 127.0.0.1 only and there is no hosted endpoint or Docker image. The script runs on the same computer as Mosaic. ### Is the local API on Mosaic's Free plan? No. The REST API and the MCP server are part of Pro, $49 a month with a 14-day free trial. ## Related [Anti-detect browser REST API: profiles from your scripts](https://mosaicbrowser.com/features/rest-api): Mosaic's anti-detect browser REST API runs on 127.0.0.1 with API keys. Create and start profiles, then attach Puppeteer or Playwright over CDP. [An anti-detect browser MCP server for your AI assistant](https://mosaicbrowser.com/features/mcp-server): Mosaic's anti-detect browser MCP server lets Claude or any MCP client create, launch and drive your profiles. 150+ tools, off by default, key-gated. [How to use Playwright with an anti-detect browser](https://mosaicbrowser.com/guides/use-playwright-with-an-anti-detect-browser): Use Playwright with an anti-detect browser by starting the profile first and attaching with connectOverCDP. Keep its context; leave the fingerprint alone. [How to automate multiple browser profiles](https://mosaicbrowser.com/guides/automate-multiple-browser-profiles): Automate multiple browser profiles by giving each account a persistent profile, starting each from a script and attaching Playwright or Puppeteer over CDP. [Local first: your profiles stay on your computer](https://mosaicbrowser.com/features/local-first): Mosaic has no cloud copy of your profiles. Profiles, cookies and proxies stay on your computer, encrypted on disk, with app lock, daily backups and a trash.   [How to use Puppeteer with an anti-detect browser](https://mosaicbrowser.com/guides/use-puppeteer-with-an-anti-detect-browser): Use Puppeteer with an anti-detect browser through puppeteer.connect: start the profile, pass its wsEndpoint, set defaultViewport to null, then disconnect. ## Run this guide on your own accounts Every Mosaic profile is a fingerprint, a proxy exit and a cookie jar that agree with each other, kept on your computer. Free holds 3 profiles. Pro is $49 a month for any number. Mosaic is a desktop app Email yourself the link and open it on your computer.