Patchright Proxy Setup: Undetected Playwright with Residential Proxies (2026)

Patchright is a patched, undetected drop-in replacement for Playwright (available for both Python and Node). Vanilla Playwright is easy to fingerprint — the biggest tell is the Runtime.enable CDP call it fires on every page, which anti-bot scripts detect directly. Patchright removes that leak and several others (the Console.enable leak, navigator.webdriver, command-line artifacts) while keeping the exact same API. You change one import and your existing Playwright code runs harder to detect. What it does not change is where your traffic comes from. This guide covers wiring residential proxies into Patchright — authenticated proxies, rotation, sticky sessions, and the fingerprint/IP consistency that decides whether you actually get through.

Why Patchright over vanilla Playwright or playwright-stealth

• The Runtime.enable leak is closed. This is the single detection vector that gets stock Playwright and Puppeteer flagged on Cloudflare, DataDome and friends. Patchright executes scripts in isolated contexts instead, so the leak never fires.
• It's a drop-in, not a plugin stack. playwright-stealth patches JS properties after the fact and lags behind detection updates. Patchright patches the driver itself and keeps the Playwright API identical.
• Least-detection defaults. It works best with channel="chrome" (real Chrome, not bundled Chromium) and a persistent context — the same posture a real user's browser has.

That makes Patchright a real upgrade on the headless and CDP detection front, and a natural sibling to nodriver if you prefer the Playwright API over raw CDP. But detection is layered — the browser is only one layer.

The part Patchright doesn't solve: your IP

A clean browser fingerprint still exits from whatever network you run it on. If that's an AWS, GCP or Hetzner range, anti-bot systems score you on ASN reputation before your patched fingerprint is ever evaluated. This is the most common reason a Patchright script passes on your laptop and dies the moment it's deployed to a cloud VM — the code didn't change, the ASN did. Residential or mobile exits carry real-user trust; Patchright handles the browser layer, proxies handle the network layer, and you need both.

Basic proxy setup

Because Patchright keeps the Playwright API, the proxy goes into the launch call exactly as it would in Playwright — and unlike Chrome's raw --proxy-server flag, Playwright accepts credentials directly, so authenticated proxies need no CDP dance:

from patchright.sync_api import sync_playwright

with sync_playwright() as p:
    browser = p.chromium.launch(
        channel="chrome",
        headless=False,
        proxy={"server": "http://us.jibaoproxy.com:913"},
    )
    page = browser.new_page()
    page.goto("https://www.jibaoproxy.com/tools/fingerprint.html")
    print(page.content())

That's enough for an IP-allowlisted gateway. Most residential gateways authenticate by username and password instead — which Playwright handles natively.

Authenticated proxies

Put the credentials straight in the proxy dict. No login dialog, no CDP Fetch handler — this is where the Playwright API is genuinely nicer than the bare DevTools Protocol:

from patchright.sync_api import sync_playwright

PROXY = {
    "server": "http://us.jibaoproxy.com:913",
    "username": "USERNAME",
    "password": "PASSWORD",
}

with sync_playwright() as p:
    browser = p.chromium.launch(channel="chrome", headless=False, proxy=PROXY)
    page = browser.new_page()
    page.goto("https://www.jibaoproxy.com/tools/fingerprint.html")
    print(page.content())

For maximum stealth Patchright recommends a persistent context. The proxy works there too — pass it to launch_persistent_context:

    ctx = p.chromium.launch_persistent_context(
        user_data_dir="./profile",
        channel="chrome",
        headless=False,
        proxy=PROXY,
        no_viewport=True,
    )

Rotating exits: one proxy per context

Playwright lets you set the proxy per browser context, so rotation is cleaner here than with a Chrome flag you can't change after launch. Give each task its own context and its own exit:

from patchright.sync_api import sync_playwright
import itertools

POOL = itertools.cycle([
    {"server": "http://us.jibaoproxy.com:913", "username": "USER", "password": "PASS"},
    {"server": "http://eu.jibaoproxy.com:913", "username": "USER", "password": "PASS"},
])

def scrape(browser, url):
    ctx = browser.new_context(proxy=next(POOL))
    page = ctx.new_page()
    page.goto(url)
    html = page.content()
    ctx.close()
    return html

Keep concurrency bounded — each context is real Chrome memory, and dozens at once will exhaust RAM long before your proxy pool complains.

Sticky sessions for logins and carts

Per-task rotation is right for stateless scraping, but anything stateful — a login, a cart, a multi-step flow — breaks if your IP changes mid-session. Hold one context (and one sticky exit) for the entire authenticated flow, and only rotate at the account or task boundary. Most residential gateways make an exit sticky by encoding a session ID in the username; keep that ID fixed for the life of the session. Rotation gets you in the door; a sticky session keeps you logged in once you're through.

Fingerprint and IP have to agree

The failure mode that survives even a good proxy is a mismatch: a US residential IP paired with a timezone, locale, or TLS/JA3 fingerprint that says something else. Patchright gives you a believable browser; make sure the exit's geography lines up with the context's locale and timezone, and don't run an obviously datacenter ASN behind a residential-looking browser. For AI agents and automation that run unattended, this consistency is what separates a session that lasts hours from one challenged on the first request.

Verify before you scale

Before pointing a Patchright fleet at a target, confirm what your exit actually looks like from the outside. Load www.jibaoproxy.com/tools/fingerprint.html through the browser to read back the JA3 fingerprint and exit IP, and confirm the ASN reads as residential/mobile — not the cloud provider you deployed on. If the fingerprint and IP both look like a real user, you've closed the two layers Patchright can't close by itself.

Summary

• Patchright fixes the browser layer — it closes the Runtime.enable leak that flags stock Playwright, with the same API.
• It does nothing for the network layer — you still exit from your own ASN.
• Unlike raw CDP, Playwright's proxy dict takes credentials directly — authenticated proxies need no Fetch handler.
• Rotate one exit per context; hold a sticky exit for stateful flows.
• Keep fingerprint, locale and IP geography consistent, and verify the exit before scaling.

JIBAO residential proxies ship with clean ASNs and browser-matched exits — exactly what Patchright needs on the network side.