TabWorker Relay: authorized browser automation

Your server plans the task. Relay executes it in Chrome tabs the customer authorizes, including up to eight concurrent background tabs. The customer keeps local controls over access.

Chrome Web Store review pending. Initial integrations are 1Matic and J3. Relay is not yet available from the Store; invited testers use development builds. No public release or Store approval is implied by these docs.

One Relay for participating applications

Applications use the finite tabworker.relay-tab/v1alpha1 protocol. The application retains its recipes and planner. Core coordinates pairing and leases, while Relay connects to the paired service’s WebSocket endpoint. Core does not need to host the application’s step loop.

Production access requires a completed developer application and manual approval. Application registration, customer pairing, and local tab authorization are separate controls. Downloading an SDK does not grant access to an installed browser.

Pair and authorize

Your registered server creates a job with its wrapper key using POST https://api.tabworker.com/api/v1/relay-tab/jobs.
The customer enters the public connection code in Relay. Core returns the paired service endpoint and connection credentials. Keep server keys and connection tokens out of URLs and logs.
Pairing makes task metadata available. It does not attach the debugger or authorize page observations.
The customer selects a task and tab, then chooses Review tab access. Relay shows the requester, service destination, purpose, sites, actions, and page-data disclosure.
Allow automation and page-data sharing grants access until the displayed expiry, at most one hour or earlier pairing expiry.

A customer can explicitly allow later jobs from the same service and requester, for the same purpose and tab, within the existing site/action scope and expiry. New scope needs another review. Each concurrently used tab requires its own grant.

Actions and observations

Relay supports clicking, typing, selecting options, waits, page outlines, screenshots, task-file attachment, and navigation within the protocol and grant. Browser effects use chrome.debugger/CDP and packaged Runtime helpers. Mouse paths and keyboard cadence are retained. Long text uses per-target text insertion; paste-event-dependent pages need compatibility validation.

The paired service receives relevant tab URLs, page text and structure, form state, screenshots, action results, and task evidence during an authorized session. Password and hidden-input values are omitted from structured outlines. Screenshots may still contain sensitive information and embedded frames; DOM filtering is not screenshot redaction. Read the privacy policy and the paired service’s own data practices.

Local control and confirmation

Pause suspends a task. Stop revokes its tab grant, blocks further actions and observations, discards late results, and detaches the debugger. Stop all applies to every Relay task. Local Stop does not need the service to be reachable. It cannot undo completed actions or recall transmitted records.

Relay presents confirmation for actions its current confirmation rules identify. A generic click/type protocol cannot guarantee recognition of every consequential business action. Applications must implement and validate their own submission, purchase, and other consequential-action policies.

Invited development testing

The default package targets Chrome 125 or later. Invited testers can load the supplied unpacked build in chrome://extensions. Source access is separate from SDK access. Public customers should wait for the official Store listing.

The package requests storage, alarms, and debugger permissions, plus HTTPS service/attachment access and literal loopback access for local testing. It does not request the scripting permission. Never expose a local test service through a public tunnel.

Validation and limits

Installed-extension tests cover eight concurrent background tabs with another tab remaining foreground, text input, selection, upload, click, outline, screenshot, Stop, and Stop all. These are controlled fixture results, not evidence that every website supports automation. Actual integration workflows still need end-to-end validation. Chrome displays its debugger indicator; Relay does not promise invisibility to websites.