Introducing BAP: Stealth Automation in Puppeteer and Playwright Without the Query Language

Introduction

Your Puppeteer or Playwright code runs fine on permissive sites, but then a target tightens its defenses, adding bot detection and fingerprinting, and every run starts to come back as a challenge page.

BrowserQL (BQL), our stealth-first GraphQL protocol, has solved that since late 2024, as long as you were willing to write GraphQL to use it.

The Browser Automation Protocol (BAP) removes that step: you write the automation code you know, and the stealth engine handles the rest. Here's what BAP is and how you can start using it.

The wall between you and stealth

Browserless does the stealth work that gets you past sites that fight automation: solving CAPTCHAs, routing residential proxies, and, on the stealth browser, randomizing fingerprints and adding human-like delays. Until now, reaching it from code meant writing BrowserQL, our GraphQL protocol, by hand.

If you write TypeScript or Python for a living, hand-writing GraphQL mutations and escaping them into JSON payloads is an extra step – enough of one that plenty of developers keep running vanilla Puppeteer or Playwright and keep getting blocked.

What is BAP?

The Browser Automation Protocol (BAP) is a typed SDK that runs your automation through Browserless's stealth engine: managed stealth, residential proxies, CAPTCHA solving, and live debugging URLs, all as methods on the page object.

It ships as two packages, generated from the same schema:

• The TypeScript package is Puppeteer-shaped, so page.goto(), page.click(), and page.type() work the way you expect.
• The Python package is Playwright-shaped, with matching sync and async surfaces.

Unlike SDKs that wrap a session around a vanilla CDP browser, every BAP command runs natively inside that stealth engine, so stealth isn't something you bolt on afterward.

Connect and run in a handful of lines

Install the package, grab a token from your dashboard, and this runs as-is:

npm install @browserless.io/bap-ts

import Browserless from "@browserless.io/bap-ts";

const browser = Browserless.connect({
  browserWSEndpoint: "wss://production-sfo.browserless.io/chromium/bql",
  token: "YOUR_API_TOKEN",
});

const page = await browser.newPage();
await page.goto("https://example.com");
console.log(await page.title());
await browser.close();

The Python SDK follows the same flow, with Playwright-style context managers that close the session for you when the block exits.

Swap the endpoint path to pick your browser:

• /chromium/bql is the default.
• /chrome/bql gives you a genuine Chrome build for sites that detect anything else.
• /stealth/bql is a privacy-hardened browser with fingerprint randomization for when both are blocked.

Anti-bot features at your fingertips

The capabilities you'd normally wire up yourself sit directly on the page object, with no third-party services to integrate. A single method call solves a CAPTCHA when one appears, geo-targets a residential proxy by country or state, or slows typing down so it doesn't fire instantly.

A few methods have no Puppeteer or Playwright equivalent at all. You can pull a page down as Markdown with markdown(), map every matching element to structured data in one request with mapSelector(), or grab a live URL with liveURL() to watch the session run in real time – handy when you're debugging why a flow stalls.

Typed code that catches mistakes before you run

Everything's typed, so your editor autocompletes as you go and catches the obvious mistakes before anything runs – a key difference compared to hand-escaped GraphQL strings, where a typo may only surface at runtime.

The package is isomorphic, so the same code runs in Node and in the browser. Running it client-side puts your token in the bundle, so only do that where your token policy allows it, and go with a server-side proxy for anything public.

BAP borrows Puppeteer's method names in TypeScript and Playwright's in Python, but it isn't a drop-in replacement for either, and it doesn't yet have full API parity. At any point, you can hand the session straight back to normal Puppeteer or Playwright and anything you've already built keeps running.

Where BAP fits in the Browserless suite

Browserless gives you two ways to automate a browser: drive a live session with a library, or fire a one-off job at the REST APIs.

For a live session, three libraries connect to the same managed browsers. Pick the one that fits your code:

• BAP: reach for a BAP SDK in TypeScript or Python when you want managed stealth as typed page methods.
• Puppeteer: connect your existing Puppeteer scripts over CDP with Browsers as a Service when you want full browser control.
• Playwright: the same path for Playwright, running the code you already have on managed browsers.

When you don't need a live session at all, the REST APIs handle one-off jobs like PDFs, screenshots, and scraping directly over HTTP.

BAP is the one of the three with managed stealth built in. It's generated from BrowserQL, which is still fully supported as the engine underneath, so every BAP call maps to a BQL mutation you could also send yourself.

Getting started

BAP works with any Browserless account, including the free tier – session duration scales with your plan. The TypeScript SDK is on npm as @browserless.io/bap-ts, the Python SDK follows as bap-py on PyPI, and the full method references live in the BAP docs.

If you've been putting off trying stealth, this is the quickest way in. Sign up to Browserless for free, grab a token, and you'll be running against the Browserless engine in a handful of lines. Point the endpoint at /stealth/bql when you need full fingerprint hardening.