PhantomBuster
MARKETING · MARKETING
Phantoms, their launches, and the leads they collect, on that person’s account.
Connect PhantomBuster with Fabriq Developer
Your user pastes their PhantomBuster credential on a page Agentic Fabriq hosts, so it never reaches your backend and never becomes one shared key across all of your users. Same call as OAuth, one more argument.
Provider names are surfaces, not vendors, and the authoritative list is the capabilities endpoint rather than any page including this one — an unknown name returns 400 with the valid list. Fabriq Developer is free to start and needs no provider paperwork. Start free or read the quickstart.
Connecting PhantomBuster in practice
PhantomBuster’s API queues browser automations rather than answering questions: POST /agents/launch "adds an agent to the launch queue" and the output is collected from the container afterwards, so the work outlives the call that started it. Authentication is the X-Phantombuster-Key-1 header, and the documentation warns against the key query-string alternative "because your key might show up in log files or caches".
Scopes that draw scrutiny
X-Phantombuster-Key-1One account key with no scopes. It can read scripts and storage, save code and launch agents, so a scraping credential is also a code-deployment credential.X-Phantombuster-OrgSelects the organization context, and some endpoints require it to be omitted, so the same key behaves differently depending on whether the call is org-scoped.
Worth knowing
- Concurrency is opt-in per launch: maxInstanceCount means the agent "will only be launched if the number of already running instances is below the specified number", so without it repeated launches stack.
- Two API versions are live under https://phantombuster.com/api/<version>/ — v1 and v2 — and v2 is the current one, so copied examples can silently target the older surface.
- A launch returns 400 when a parameter is duplicated or the launch argument is too big, so a large bonusArgument fails rather than truncating.
- bonusArgument is single-use and merged into the agent’s stored argument, so per-run configuration is a merge rather than a replacement.
Checked against PhantomBuster API guide (2026-09-29), /agents/launch reference (2026-09-29), API reference index (2026-09-29)
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Often connected alongside
Put PhantomBuster behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.