Guide

Multilogin X API authentication

Ninety percent of “Playwright won’t connect” nights are expired tokens or a sign-in body that still sends a raw password. Fix PAM first.

Official flow: Configure Postman · collection: Postman documenter → folder Profile Access Management.

Sign-in pattern (from Multilogin help + samples)

POST https://api.multilogin.com/user/signin
Content-Type: application/json

{
  "email": "you@agency.com",
  "password": "<md5-hex of your Multilogin password>"
}

→ 200: data.token   // ~30 minutes per Multilogin Postman help
→ use Authorization: Bearer {token} on later calls

Official JS/Python Playwright samples also hash the password with MD5 before sign-in. Do not commit email/password/token into git — env or secret manager only.

Keep the token alive

• Refresh — User Refresh Token endpoint in the same PAM folder.
• Automation token — Multilogin’s help says you can mint one and set expiry yourself for longer unattended runs.
• When every Launcher call returns 401, re-auth before debugging CDP ports — token desk.

Then what

Start profiles: Postman · Attach code: Playwright · Domain map: API map.

Node one-liner (hash)

import { createHash } from "node:crypto";
const password = createHash("md5").update(plainPassword, "utf8").digest("hex");

Match Multilogin’s official samples. Free plan still cannot call API after a perfect hash — upgrade to Pro+.

Common 401 causes

• Plain password in JSON body
• Expired Bearer reused across a long job
• Wrong API host / typo’d Authorization header
• Testing on Free — no API at all

Get Multilogin deal Next: Playwright