Real apps, safely

browser-clip runs scripts for real. This guide keeps captures repeatable and harmless, with mocked data, blocked trackers and a saved login.

Point it at a safe target#

A capture loads the pages and clicks the buttons. Prefer, in this order:

1. a local dev server or a fixture page;
2. staging, with test accounts;
3. a read-only public page.

Never let a script buy, send a message or an email, publish, delete or change account settings on a real account. Show made-up data: user dev, example.com addresses, no real names, emails or tokens.

Mock the data the viewer sees#

capture.mocks answers requests from the script, and capture.block fails the ones that should not happen (analytics, trackers):

capture:
  mocks:
    - url: "**/api/projects"        # any origin; the query string is ignored
      json:
        - { name: Launch plan, owner: dev@example.com }
        - { name: Q4 roadmap, owner: ana@example.com }
    - url: "**/api/me"
      json: { name: Dev, plan: Team }
      delay: 0.6                    # long enough to show the loading state
  block: ["**/analytics/**"]
script:
  - goto: /projects.html
  - wait: { text: Q4 roadmap }

• * matches within a path segment and ** across segments; /path is that path on any origin (**/path also matches it deeper in a URL).
• A mock answers with json, body text or a file next to the script, with a status, headers and a delay. CORS is answered for you, preflights and credentials included, so an API on another origin works as is.
• capture reports what it mocked and blocked, and warns about a mock nothing asked for and a block that blocked nothing.
• Mocks and blocks are part of the take: changing them captures again.

Start signed in#

login opens a visible browser window; sign in by hand with a test account, then press Enter to save the session's cookies and local storage:

browser-clip login https://staging.example.com -o staging.storage.json

capture:
  login: staging.storage.json       # next to the script

Time and randomness#

• capture.clock: 2026-10-12T09:30:00Z sets the page's clock to that moment when the capture starts (it then runs normally, one clock for every page of the capture), so "2 minutes ago" says the same thing in every take. Without the Z or an offset such as +02:00, the time is read in capture.timezone.
• capture.timezone: Europe/Madrid sets the time zone. The language and number and date formats stay the machine's.
• seed decides the pointer paths and the typing rhythm; change it for another take of the same script.

Source: docs-src/pages/guides/real-apps.md · browser-clip 0.1.0