Bring your own proxy for an Orgo computer's browser

Orgo computers run in data centers, and some websites challenge or restrict traffic from data center addresses. Browser networking lets you send a computer's browser traffic through your own HTTP CONNECT proxy, so websites see your proxy's exit IP instead.

You set it with one API call on a running Linux computer. The dashboard has no switch for it today. It covers Chrome, not every program on the computer. Turning it on the first time restarts Chrome if it is open. And a proxy does not guarantee that a website will accept automated traffic.

What is Orgo browser networking?

Browser networking is the setting that decides where a computer's browser traffic leaves for the internet. By default it leaves from the data center the computer runs in. With a custom upstream, a small relay on the computer forwards Chrome's traffic to a proxy you provide, and websites see that proxy's address.

It is a setting on each computer, not a separate product. The computer is still a full desktop with a browser, terminal and files; only the route Chrome takes changes. The browser networking guide is the reference.

Why do websites challenge AI agent computers?

Many websites treat traffic from data center address ranges differently from traffic from homes and offices. A challenge can be a captcha, a block page, or a page that loads differently than it does on your own network. The address range is one common cause.

A proxy changes one input to that decision: the exit IP. It does not change anything else a website may look at, which is why Orgo does not promise acceptance.

Data center exit vs your own proxy: what changes?

How do I set my own proxy on an Orgo computer?

Send POST /api/computers/{id}/egress/upstream with "mode": "custom" and your proxy's details. The API base URL is https://www.orgo.ai/api, and every request carries your Orgo API key as Authorization: Bearer $ORGO_API_KEY (authentication).

curl -X POST "https://www.orgo.ai/api/computers/$COMPUTER_ID/egress/upstream" \
  -H "Authorization: Bearer $ORGO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "mode": "custom",
    "upstream": {
      "host": "proxy.example.com",
      "port": 443,
      "user": "your-proxy-user",
      "pass": "your-proxy-password",
      "tls": true
    }
  }'

The fields:

• host: your proxy's hostname or IPv4 address, with no scheme, port or path (proxy.example.com, not https://proxy.example.com).
• port: your proxy's port, from 1 to 65535.
• user and pass: your proxy credentials, sent to the proxy with Basic authentication. The username cannot contain a colon. The password is encrypted when stored.
• tls: whether the computer connects to the proxy over TLS. It describes the hop to the proxy, not to the website, and defaults to false. With true, the proxy must present a certificate that the computer trusts and that matches the host you set. Without TLS, your proxy credentials travel unencrypted to the proxy, so turn it on if your provider supports it.

Use the host, port and TLS setting your provider gives you. Each call replaces the whole upstream, so send the password again whenever you change any field.

The response includes proxy_on and exit_ip, the address Orgo saw when it checked the new route through your proxy, or null if it could not read one.

How do I check which proxy a computer is using?

Send GET /api/computers/{id}/egress/upstream:

{
  "mode": "custom",
  "device_id": null,
  "upstream": { "host": "proxy.example.com", "port": 443, "user": "your-proxy-user", "tls": true },
  "proxy_on": true,
  "exit_ip": "203.0.113.10"
}

The response never includes the proxy password, so you can log it without leaking the credential. Read proxy_on to see whether Chrome is routed through the relay, and exit_ip for the address Orgo measured through your proxy when it applied the route. If your provider rotates addresses, websites may see others.

A computer you never set answers "mode": "residential" with "proxy_on": false. That is the field's default value, and the browser on that computer goes out directly from the data center.

What happens to Chrome when I turn the proxy on?

The first time you set a custom upstream, Orgo installs the relay and points Chrome at it with a managed Chrome policy. If Chrome is open, it restarts to pick up the policy, so save browser work first.

Once the relay is on, changing the upstream restarts only the relay. Chrome keeps running; open connections drop and Chrome reconnects on its next request.

Set the proxy before your agent starts a long browser session, not in the middle of one.

Does the proxy cover every program on the computer?

No. Only Chrome is pointed at the relay.

The same policy turns off QUIC in Chrome and stops WebRTC from sending UDP outside the proxy. If an agent mixes browser work with direct HTTP calls from a script, expect the two to exit from different IP addresses.

Why did my request fail?

• 400: the request is malformed. Common causes are a missing or misspelled mode, a host that includes a scheme or path, a port outside 1 to 65535, or a username with a colon.
• 409: the change could not be applied. An asleep computer answers with the code computer_asleep, and a computer that is not ready answers 409 too, so start or wake it and try again. A 409 can also mean Orgo could not reach the internet through your proxy, in which case it kept the previous route.

What if my proxy settings are wrong?

Orgo tests a new route before it keeps it: from the computer, it requests https://api.ipify.org through your proxy. If that fails, because of a wrong host, wrong credentials, or a proxy that refuses the request, the computer keeps its previous route and Orgo restores the previous setting. A typo does not leave the browser without a way out.

Confirm the change with the GET call before you hand the computer back to your agent.

What happens if my proxy goes down later?

Chrome's requests fail until the proxy answers again. Orgo does not send them out from the data center address in the meantime, so check your provider's status before you look for a problem on the computer.

Does a proxy get my agent past bot detection?

Not by itself, and Orgo does not claim it does. A proxy changes the exit IP. It does not guarantee that a website will accept automated traffic. Treat it as one option for sites that restrict data center addresses, and follow each site's terms for automated access.

How is this different from a template egress policy?

They answer different questions. A template can declare an egress_policy with allow or block rules for domains, IPs and CIDR ranges, which filters the names the computer can look up and the addresses it can connect to. Browser networking sets where Chrome's traffic exits. Publishing templates needs a Scale plan or higher.

If you use both, Chrome's traffic goes to one place: your proxy. The policy's rules apply to that connection, not to the sites Chrome reaches through it. With an allow policy, add your proxy's hostname or IP to the rules, or the computer may not be able to reach the proxy.

Who is browser networking for?

It is for teams whose agents do real work in a browser on sites that treat data center traffic differently, and who already have proxy credentials from a provider they trust. The upstream is set per computer, so when every agent or user gets its own computer, each one can have its own proxy settings. See how to scale agent computers.

FAQ

Does Orgo provide the proxy? The documented flow is bring your own: you give Orgo your provider's host, port and credentials.

What kind of proxy does Orgo support? An HTTP proxy that supports CONNECT, with optional Basic authentication and an optional TLS connection to the proxy. SOCKS proxies are not supported.

Does it work on Windows or macOS computers? No. Browser networking is only for running Linux computers.

Related

• What is computer use?
• Cloud desktops vs. headless browsers
• Run Claude computer use on Orgo