Automate Browser Tasks in a Sandbox

AI-powered browser automation running in an E2B sandbox

The Browser Use Sandbox tool runs the open-source browser-use framework inside a secure E2B sandbox. Describe what you want the agent to do in plain language, and it will navigate the web, fill forms, extract data, and more — all powered by OpenAI models.

For Human-in-the-Loop workflows, set keep_session: true to pause after the task and receive a sandbox_id. Pass that sandbox_id back to a subsequent BROWSER_USE_SANDBOX_RUN_TASK step to reconnect to the same browser session and continue.

Configuration

Field	Description
openai_api_key	Your OpenAI API key. Leave blank to use Jinba Credit.
timeout	Execution timeout in milliseconds (default: 600000 = 10 min)

Inputs

Field	Type	Description
task	string	Natural-language description of what to do in the browser
sandbox_id	string	E2B sandbox ID from a previous run with keep_session: true. When provided, reconnects to that session and continues. Use {{steps.<step_id>.result.sandbox_id}}. Leave empty to start a new session. Only a sandbox started in the same workspace can be resumed; any other ID is rejected before connecting.
llm_model	enum	OpenAI model to use (gpt-4.1 / gpt-4.1-mini / gpt-5.1)
max_steps	number	Maximum agent steps (default: 20, maximum: 100). A larger value runs as 100.
capture_screenshot	boolean	Return a signed URL to the final browser screenshot
keep_session	boolean	Keep the browser session alive after the task completes. Only used when starting a new session (no sandbox_id). Returns sandbox_id and current_url for use in a subsequent step.

Credit cost

When openai_api_key is blank, the step is billed in Jinba Credit per token, at the rate of the llm_model you pick — not a flat fee per step. Supplying your own key bills OpenAI directly and costs no credits.

• Before the run, credits are reserved: max_steps × the tokens one browser step typically sends (each step re-sends the page DOM and the run history), at that model’s rate. The reservation is also the admission check — a balance below it refuses the step before the sandbox starts.
• After the run, the reservation is replaced by the token usage the agent actually reported, whether the task succeeded or failed. Only the reservation is capped at max_steps: 100; the final charge follows real usage.
• A run that ends without reporting any usage is charged the tool’s fixed minimum. This is not a per-run price: a run that reports its usage is charged for its tokens.
• A step that runs over a list (forEach) is settled per iteration. Each iteration is billed by the two rules above as if it had run alone: its own reported tokens, or the minimum when it reported none. The step’s charge is the sum over all iterations. Only the reservation is still a single iteration’s figure — so the admission check does not bound the final charge, and a 20-iteration loop can settle at up to 20× what one iteration costs. Budget a forEach browser-use step at one iteration’s cost × the number of items, not at its reservation. Inside a flow run, the balance is checked again before each batch of iterations: a batch starts only as many iterations as the remaining balance covers at one reservation each, after what the finished iterations cost, so a loop on a low balance runs with less parallelism. When not even one more reservation fits, the loop stops there — the next iteration fails with InsufficientCredits, the rest are skipped, and the iterations that ran keep their results and are charged. “Run Step” has no such check, and neither does a loop placed inside a subflow.

Every run reserves at least the tool’s minimum charge. Above that, the reservation grows with max_steps and with the price of llm_model, so raising max_steps raises what your balance must cover up front, even for a task that finishes in a few steps. The step’s badge reads “Dynamic pricing”; the usage page shows what each run was charged (How tools are priced).

Outputs

Field	Type	Description
output	string	The agent’s final answer
is_done	boolean	Whether the agent completed the task
steps	array	Per-step action / extracted_content / error
screenshot	string	Signed URL to the final screenshot
files	array	Files the agent downloaded. Absent when nothing was downloaded
sandbox_id, current_url	string	Set when keep_session: true

files[]

Field	Description
filename	Name the site gave the download
url	Signed Jinba URL. Pass it to a later step
size	Size in bytes
content_type	Guessed MIME type
error	Why this file has no url

A file is never dropped silently — if it cannot be carried out, the entry comes back with error instead of url. Reasons: over 10 MB, the run total over 20 MB, more than 20 files, the download was still in progress when the agent stopped, or the extension is outside the accepted set.

Accepted extensions: csv, html, json, txt, xml, yaml, yml, md, tsv, log, sql, xls, xlsx, pdf, docx, pptx, png, svg, jpg, jpeg, gif, webp.

Typing a secret the agent must not see

Write <secret>MY_SECRET</secret> in task, where MY_SECRET is the name of a workspace secret. The agent and the LLM only ever see the placeholder; the real value is restored in the browser action that types it, and the step output records Typed sensitive data rather than the value.

- id: login
  tool: BROWSER_USE_SANDBOX_RUN_TASK
  input:
    - name: task
      value: |
        Go to https://portal.example.com and sign in with
        <secret>PORTAL_ID</secret> and <secret>PORTAL_PASS</secret>,
        then download the latest CSV.

Do not write {{secrets.MY_SECRET}} in task. It is expanded before the step runs, so the value is recorded in the step’s input and sent to the LLM. The step fails with a ConfigurationError when it detects one — including in flows that worked this way before this behaviour existed.

Only workspace and organization secrets can be used. Personal (user-scoped) secrets are not visible to this tool.

The secret is scoped to the agent, not to a site: browser-use will type it on whatever page the agent reaches. Keep the task specific about which sites to visit, and prefer a credential whose blast radius you accept.

Example — Simple task

- id: browse
  tool: BROWSER_USE_SANDBOX_RUN_TASK
  input:
    - name: task
      value: "Go to https://example.com and return the page title and main heading text."
    - name: llm_model
      value: gpt-4.1-mini
    - name: max_steps
      value: 10

Example — Human-in-the-Loop form submission

- id: fill_form
  tool: BROWSER_USE_SANDBOX_RUN_TASK
  input:
    - name: task
      value: "Go to https://example.com/contact, fill in the name and email fields, then stop before clicking submit."
    - name: llm_model
      value: gpt-4.1
    - name: keep_session
      value: "true"

- id: wait_for_approval
  tool: WAIT_FOR_APPROVAL
  input:
    - name: message
      value: "Please review the filled form and approve to submit."

- id: submit_form
  tool: BROWSER_USE_SANDBOX_RUN_TASK
  needs: [fill_form, wait_for_approval]
  input:
    - name: sandbox_id
      value: "{{steps.fill_form.result.sandbox_id}}"
    - name: task
      value: "Click the submit button. Reviewer comment: {{steps.wait_for_approval.result.comment}}"
    - name: llm_model
      value: gpt-4.1
    - name: capture_screenshot
      value: "true"