Multi-user applications
Authorize a user before acting on a stored browser session.
Store a relationship between your user, task, and session. Keep the project key on your backend.
Authenticated user → Owned task → Stored session ID → TabSailBackend authorization
This TypeScript fragment assumes db, userId, and client come from your application:
const task = await db.tasks.findFirst({
where: { id: taskId, userId },
});
if (!task) throw new Error("Task not found");
const viewer = await client.sessions.connections.create(task.sessionId, {
type: "live",
mode: "view",
});
// Return viewer.url only to this authorized user.Apply the same check before closing, taking control, or retrieving files. Never forward an arbitrary caller-supplied session ID with an unrestricted project key.
| Store with the task | Purpose |
|---|---|
| User ID and task ID | Application ownership |
| Project ID and session ID | Remote resource |
| Creation key and original parameters | Unknown-result recovery |
| Completion and cleanup state | Restart recovery |
Use separate sessions for independent website accounts. Metadata and multiple tabs do not establish user authorization.
Use a separate Profile for each authorized website account. Profiles belong to the project; your backend maps them to users.
Your application's user authorization remains required. See security.