---
title: "Create Browser Tokens"
method: POST
path: "/browser-tokens"
tags: ["Core", "Browser Tokens"]
---

# Create Browser Tokens

`POST /browser-tokens`

## Request

- Base URL: `https://api.evervault.com`
- URL: `https://api.evervault.com/browser-tokens`
- Auth: HTTP basic
- TypeScript: <https://skmtc.dev/evervault/apis/evervault-api/docs/browser-tokens/post.ts> (a function with typed inputs; its response is checked against the schema)

Creates format-preserving [Browser Tokens](/browser-tokens) for a browser automation session, along with the credentials for Evervault's browser proxy.

Pass the token values to your agent or browser instead of the sensitive values. When the browser sends a token value through the browser proxy to a hostname allowed by `permissions`, Evervault replaces it with the plaintext over the wire. Requests to any other hostname receive the token value.

Tokens can be reused until the `ttl` expires. Evervault doesn't store the mapping between token values and plaintext values.

Browser Tokens are in preview. Contact [support@evervault.com](mailto:support@evervault.com) for access.

## Request body

- object
  - `data` object[], required: The sensitive values to convert into token values. Values can be Evervault-encrypted or plaintext. Accepts between 1 and 24 entries.
    - `category` 'card.number' | 'card.cvv' | 'credential.password', required: The semantic type of the value, which determines the token format.
    - `value` string, required: The sensitive value. Use Evervault-encrypted values for production integrations.
    - `id` string, required: Your identifier for the value, used to find its token in the response and reflected in the Evervault logs. Must be unique within the request.
  - `permissions` object[], required: The hostnames where token values can be revealed as plaintext. Treat them as an allowlist and scope them as tightly as possible. Accepts between 1 and 32 permissions.
    - `action` 'decrypt', required: The action to allow.
    - `target` string, required: The hostname that can receive the plaintext value. Matching ignores case. - An exact hostname, such as `checkout.example.com`, matches that hostname only. - A subdomain wildcard, such as `*.example.com`, matches any subdomain at any depth, but not `example.com` itself. It needs at least two labels after `*.`. - `*` matches every hostname. This removes the hostname check entirely, so avoid it in production. Targets with a scheme, port, path, or a `*` anywhere other than a leading `*.` are rejected, and no tokens are created.
  - `ttl` integer: How long the tokens and proxy credentials remain valid, in seconds. Must be at least `1`. Use the shortest `ttl` that covers the expected session, including login, MFA, or human takeover.
  - `proxySettings` object: Routes the session's egress through your own `CONNECT` proxy instead of Evervault's IP addresses.
    - `type` 'custom', required: The type of egress proxy.
    - `scheme` 'http' | 'https', required: Use `https` if your egress proxy supports CONNECT-over-TLS, otherwise use `http`.
    - `hostname` string, required: The hostname or IP address of the egress proxy. Don't include a scheme or port.
    - `port` integer, required: The port of the egress proxy.
    - `username` string, required: The username for basic auth with the egress proxy. Can't be blank.
    - `password` string, required: The password for basic auth with the egress proxy. Can't be blank.
  - `externalCustomerReference` string: An optional reference of your choice, such as a correlation ID, that is attached to the request. The reference will be visible in your logs. Must be between 1 and 255 characters.

## Response `201`

The Browser Tokens have been created

- BrowserTokenSession
  - `sessionId` string, required: The unique identifier for the browser session. Activity for the session is logged under this ID.
  - `data` object[], required: A token for each value in the request, in the same shape and order. Pass these to your agent or browser in place of the sensitive values.
    - `category` string, required: The category of the value, as sent in the request.
    - `value` string, required: The format-preserving token value. It's revealed as plaintext only when sent through the browser proxy to a hostname allowed by `permissions`.
    - `id` string, required: The `id` sent in the request, used to find each token.
  - `proxyConfiguration` object, required: The credentials the browser uses to connect to Evervault's browser proxy, an HTTP `CONNECT` proxy. The browser must also trust the Evervault CA.
    - `hostname` string, required: The hostname of the browser proxy.
    - `port` integer, required: The port of the browser proxy.
    - `username` string, required: The username for basic auth with the browser proxy. This is your App ID.
    - `password` string, required: The password for basic auth with the browser proxy. It's a short-lived encrypted JWE that expires with the tokens, so treat it like any other session credential.

## Changes

- **2026-11-06** `8d0ca833fa04`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/evervault/apis/evervault-api/changes/browser-tokens/post.md)

---

[API](https://skmtc.dev/evervault/apis/evervault-api.md) - [All operations](https://skmtc.dev/evervault/apis/evervault-api/llms.txt) - [OpenAPI document](https://skmtc.dev/evervault/apis/evervault-api/revisions/8d0ca833fa04?raw)