PhantomBuster
MARKETING · MARKETING
Phantoms, their launches, and the leads they collect, on that person’s account.
Connecting PhantomBuster in practice
PhantomBuster’s API queues browser automations rather than answering questions: POST /agents/launch "adds an agent to the launch queue" and the output is collected from the container afterwards, so the work outlives the call that started it. Authentication is the X-Phantombuster-Key-1 header, and the documentation warns against the key query-string alternative "because your key might show up in log files or caches".
Scopes that draw scrutiny
X-Phantombuster-Key-1One account key with no scopes. It can read scripts and storage, save code and launch agents, so a scraping credential is also a code-deployment credential.X-Phantombuster-OrgSelects the organization context, and some endpoints require it to be omitted, so the same key behaves differently depending on whether the call is org-scoped.
Worth knowing
- Concurrency is opt-in per launch: maxInstanceCount means the agent "will only be launched if the number of already running instances is below the specified number", so without it repeated launches stack.
- Two API versions are live under https://phantombuster.com/api/<version>/ — v1 and v2 — and v2 is the current one, so copied examples can silently target the older surface.
- A launch returns 400 when a parameter is duplicated or the launch argument is too big, so a large bonusArgument fails rather than truncating.
- bonusArgument is single-use and merged into the agent’s stored argument, so per-run configuration is a merge rather than a replacement.
Checked against PhantomBuster API guide (2026-09-29), /agents/launch reference (2026-09-29), API reference index (2026-09-29)
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Often connected alongside
Put PhantomBuster behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.