Copy page

Guides

Chromium CDP with Token Authentication

This example uses Chromium, a headless browser exposing a CDP (Chrome DevTools Protocol) websocket interface, with token-based authentication and persistent storage.

Features

• Token authentication: All CDP requests (HTTP and WebSocket) require a valid token
• Admin API: Create, list, and revoke tokens via REST endpoints
• Bootstrap token: Set an initial admin token via environment variable
• Persistent storage: The token database is stored on a volume that survives restarts

To run this example, follow these steps:

1. Install the CLI. Use the unikraft CLI or the legacy kraft CLI. You need a BuildKit builder. The easiest way to get one is via Docker. Alternatively, you can also directly set up and use BuildKit, see the quick start.

   The unikraft CLI is the current standard, while kraft is the legacy version. Choose one of the CLIs below and only run the commands associated with it for the rest of this guide.

2. Clone the examples repository and cd into the examples/chromium-cdp-auth/ directory:

   Code
   git clone https://github.com/unikraft-cloud/examples
   cd examples/chromium-cdp-auth/

Make sure to log into Unikraft Cloud and pick a metro close to you. This guide uses fra (Frankfurt, 🇩🇪):

The UKC_TOKEN and UKC_METRO environment variables are only supported by the legacy CLI.

Pick a bootstrap admin token that will be used for initial setup. You pass it to the instance as the BOOTSTRAP_ADMIN_TOKEN environment variable (see the deploy commands below) and use it to create additional tokens:

Code
export BOOTSTRAP_ADMIN_TOKEN=my-secret-admin-token

The token database is persisted on a volume mounted at /app/data, so it survives restarts. First create the volume:

When done, invoke the following command to deploy this app on Unikraft Cloud, mounting the volume and passing the bootstrap token:

The output shows the instance address and other details.

In this case, the instance name is chromium-cdp-auth-d0l6y and the address is https://spring-dream-p5wxwwl0.fra.unikraft.app. They're different for each run.

Authentication

All CDP endpoints require a valid token, passed either as:

• Query parameter: ?token=<TOKEN>
• Authorization header: Authorization: Bearer <TOKEN>

The bootstrap admin token (set via the BOOTSTRAP_ADMIN_TOKEN environment variable) can be used for initial setup. Use it to create additional tokens.

Token management API (admin only)

Create a token:

Code
curl -X POST https://<instance-url>/api/tokens \
  -H "Authorization: Bearer $BOOTSTRAP_ADMIN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name": "my-client", "expiresInDays": 7}'

List tokens:

Code
curl https://<instance-url>/api/tokens \
  -H "Authorization: Bearer $BOOTSTRAP_ADMIN_TOKEN"

Revoke a token:

Code
curl -X DELETE https://<instance-url>/api/tokens/<token> \
  -H "Authorization: Bearer $BOOTSTRAP_ADMIN_TOKEN"

Public endpoints

• GET /health — health check (no auth required)

Testing

To query the service you need to use a CDP client. You can use the Python-based implementation in the test/ directory. See test/README.md for setup and a screenshot example that passes a token.

Instance management

You can list information about the instance by running:

When done, you can remove the instance:

Learn more

• CDP Documentation
• Unikraft Cloud's Documentation
• Building Dockerfile Images with Buildkit

Use the --help option for detailed information on using Unikraft Cloud:

Or visit the CLI Reference or the legacy CLI Reference.