What you’re integrating
Anchor SDK in CreateOS’s base image → Anchor Cloud. The sandbox stays vanilla and lightweight. Chromium runs as a managed Anchor cloud session; the sandbox just holds the SDK and talks to it over HTTPS + CDP.- CreateOS stays the code runtime — install packages, run a script, call a model.
- Anchor stays the remote browser — stealth, proxies, live view, and session lifecycle.
- Do not launch a browser inside the sandbox.
Preinstall the SDK
Install into the image app directory — not globally.npm install -g is not importable from user projects.
playwright / playwright-core are only needed for direct CDP control, not for agent.task / agentTask.
Alias the env var the raw SDK actually reads, so code that does not call setConfig / api_key= still works:
ENV line or in the sandbox entrypoint. Without this alias, session and task calls fail auth (401) even when ANCHOR_API_KEY is set.
API key (BYOK)
Each CreateOS customer brings their own Anchor API key as a sandbox secret:ANCHOR_API_KEY=sk-.... List it in CreateOS’s secrets UI as a known integration.
Anchor bills the customer directly on usage — CreateOS does not meter or bill browser usage.
Keyless trial (optional): agents without a key can self-provision a small trial key via Agent Access — guide → puzzle challenge (120s TTL) → submit the answer for an
api_key, sent as header anchor-api-key. Trial keys are capped (1 credit, 60-minute session cap). Fine for exploration, not a BYOK replacement. Do not market this as unlimited browser access.Expose a browser tool
Wrap the SDK so agents call it declaratively.agent.task (Python) / agentTask (Node) return an object; the result string is result.data.result.
Optional: full Playwright control
Connect over CDP to the created cloud session (session.data.cdp_url).
Session hygiene
- Reuse one session per agent run — do not create a session per page.
- Set
timeout.max_duration/timeout.idle_timeout(minutes) so abandoned sandboxes do not hold browsers open. See Session Timeout. - Delete the session on sandbox teardown (
delete_session/deleteSession). - Show
live_view_urlin the sandbox UI so users can watch the browser run.
Egress
If CreateOS sandboxes restrict egress, allowlist:https://api.anchorbrowser.iowss://connect.anchorbrowser.iohttps://live.anchorbrowser.io

