Request Isolation
One browser per call. Then gone. No shared cookies, no leaked state — and private targets never leave the gate.
Overview
Fresh browser. Closed network.
Microlink does not reuse browsers across calls. Each request boots an isolated instance, runs the job, and tears it down — so one URL can never see another’s cookies, storage, or session. Before any navigation, the target is checked for SSRF: private, loopback, and link-local addresses reject with
EFORBIDDENURL. Same guarantees on every product and every plan — see the API overview.- One ephemeral browser per request — created, used, destroyed
- No cookies, storage, or session state shared between calls
- SSRF gate: private, loopback, and link-local URLs never navigate
- EFORBIDDENURL fails closed before the browser starts
- Typed MicrolinkError with code, statusCode, and description
Examples
Isolation you do not configure.
SSRF is refused
import createClient from 'microlink.io'
const microlink = createClient({
apiKey: process.env.MICROLINK_API_KEY
})
await microlink.metadata(
'http://169.254.169.254'
)
// → MicrolinkError { code: 'EFORBIDDENURL' }