Playwright Proxies: Authentication, Per-Context Rotation and Real Geo Testing

The setup itself is short — the Playwright integration page has the copy-paste version. This article covers the parts that decide whether a Playwright job survives contact with a real target.

Browser-level versus context-level

const { chromium } = require("playwright");

// One exit for the whole browser process.
const browser = await chromium.launch({
  proxy: { server: "http://PROXY_HOST:PROXY_PORT" },
});

// One exit per context — this is the useful one.
const context = await browser.newContext({
  proxy: {
    server: "http://PROXY_HOST:PROXY_PORT",
    username: "USERNAME",
    password: "PASSWORD",
  },
});

Context-level configuration means a single browser process can run ten identities in parallel, each with its own exit, cookies and storage. Launching ten browsers to achieve the same thing costs roughly ten times the memory for no benefit.

Credentials: fields, not URLs

Chromium's --proxy-server flag takes no credentials. That limitation is why Puppeteer needs an explicit authentication step, and Playwright's contribution is to handle it for you — but only if you use the username and password fields. Embedding them in the server string produces a silent 407 that looks like a network failure.

// Wrong: Chromium drops the userinfo, the request is unauthenticated.
proxy: { server: "http://USERNAME:PASSWORD@PROXY_HOST:PROXY_PORT" }

// Right: Playwright answers the proxy's auth challenge for you.
proxy: {
  server: "http://PROXY_HOST:PROXY_PORT",
  username: "USERNAME",
  password: "PASSWORD",
}

Rotation across contexts

Because the exit is selected by the username, rotation in Playwright is a matter of generating a new session identifier per context and disposing of the context when the job is done.

const crypto = require("crypto");

async function withFreshExit(browser, country, fn) {
  const tag = crypto.randomBytes(4).toString("hex");
  const context = await browser.newContext({
    proxy: {
      server: "http://PROXY_HOST:PROXY_PORT",
      username: `USERNAME-country-${country}-session-${tag}`,
      password: "PASSWORD",
    },
    locale: country === "de" ? "de-DE" : "en-US",
    timezoneId: country === "de" ? "Europe/Berlin" : "America/New_York",
  });

  try {
    return await fn(context);
  } finally {
    await context.close();   // frees the exit and the cookie jar together
  }
}

The mismatch that gives you away

A German exit IP serving a browser reporting en-US, America/New_York and a Californian geolocation is a stronger bot signal than the datacenter IP you were trying to avoid. Real users are internally consistent; the value of a geo-targeted exit disappears if the browser contradicts it.

const context = await browser.newContext({
  proxy: { server: "http://PROXY_HOST:PROXY_PORT", username: "USERNAME-country-de", password: "PASSWORD" },
  locale: "de-DE",
  timezoneId: "Europe/Berlin",
  geolocation: { latitude: 52.52, longitude: 13.405 },
  permissions: ["geolocation"],
  viewport: { width: 1440, height: 900 },
});

Verify the exit inside the browser

Trusting the configuration is how silent fall-through to a direct connection goes unnoticed. Check from inside the page, because that is the path the target actually sees.

const page = await context.newPage();
await page.goto("https://api.ipify.org?format=json");
console.log(await page.locator("pre").innerText());

Things that waste an afternoon

• `--proxy-server` in `args`. Playwright's proxy option is the supported path; the raw flag bypasses the credential handling.
• `NO_PROXY` in the environment. It applies to Playwright too and will quietly exclude the host you care about.
• Reusing one context for everything. Cookies, storage and service workers persist, so identity two inherits identity one.
• Ignoring `context.close()`. Long-running jobs leak memory and hold sticky exits far longer than intended.
• Loading images you never look at. Route interception to block images and fonts typically cuts bandwidth by more than half, which matters when you pay per GB.

await context.route("**/*", (route) => {
  const type = route.request().resourceType();
  return ["image", "font", "media"].includes(type)
    ? route.abort()
    : route.continue();
});

Block carefully, though: some targets check that the assets they served were actually fetched. If a page starts failing only after you add interception, that is the first thing to reverse.

Playwright gives you honest browser behaviour by default, which is most of the battle. The remaining work is making sure everything the browser reports agrees with where the traffic appears to come from — and that is a configuration problem, not an evasion problem.