An interactive visual guide exploring how Orca's built-in agent browser overcomes Google's anti-bot blocks, manages multi-tenant session partitions, and maintains high-fidelity CHIPS cookie state.
Google employs some of the web's most sophisticated fraud prevention and session binding mechanisms. When running inside an embedded agent browser shell, three distinct hurdles arise:
Google inspects User-Agent tokens, Client Hints (Sec-CH-UA), and automation variables. If it detects Electron or an automated agent browser, sign-in is immediately denied.
Google cookies (SID, SAPISID, __Secure-1PSID) are cryptographically bound to the physical browser instance.
Standard Electron APIs (cookies.set) silently discard CHIPS partition keys (topLevelSite), breaking third-party iframe logins and SSO.
Click any pillar below to jump directly into its interactive deep-dive demonstration:
When Orca navigates to accounts.google.com, it dynamically swaps the UA to authentic Firefox, strips Client Hints, and neutralizes bot signals. The user signs in natively inside Orca's browser, producing permanent, self-refreshing credentials.
Each workspace / profile in Orca is strictly segregated via Electron partitions (persist:orca-browser-session-...). Work and personal accounts never collide or bleed state across worktrees.
Orca bypasses Electron's lossy cookies.set by leasing a Chrome DevTools Protocol (CDP) debugger to write partitioned cookies directly with full topLevelSite fidelity.
During cookie imports, Google domains (NON_TRANSPLANTABLE_DOMAINS) are exempted from overwriting or clearing, preserving live native sessions forever.
Test what Google and web servers see during navigation with and without Orca's adaptive auth handler.
Modern web security isolates third-party cookies by their top-level site context. Here is why default Electron fails and how Orca's agent browser solves it with Chrome DevTools Protocol (CDP).
session.cookies.set()
Electron's high-level cookies API silently ignores partitionKey.
Result: Embedded Google login iframes or third-party OAuth widgets cannot find their partitioned cookies and fail.
Network.setCookie
Orca acquires a leased CDP debugger connection to talk directly to Chromium's internal Network domain.
Result: Full support for CHIPS cookies, cross-site ancestor keys, and resilient embedded logins.
| Cookie Name | Domain | Partition Key (topLevelSite) | Cross-Site Ancestor | Storage Mechanism |
|---|---|---|---|---|
| __Host-partitioned_session | accounts.google.com | https://workspace.app | true | |
| oauth_partner_id | youtube.com | https://service.partner.io | true | |
| session_id (Standard) | github.com | (Unpartitioned / apex) | false |
When a user imports cookies from Chrome, Brave, or Firefox into Orca, what happens to their Google session?
Before modifying any cookie coordinate in Orca, the store takes an exact CDP snapshot of the target session. If any network command fails halfway, restoreClearIdentities() rolls back the entire coordinate losslessly in reverse order.
How Orca orchestrates the Electron main process, CDP debugger lease, dynamic user agent router, anti-detection shields, and partitioned cookie stores.
Everything runs inside the local partition instance. No credentials or tokens leave the developer's machine.
Page.addScriptToEvaluateOnNewDocument overrides CDP debugger flags, plugin arrays, and automation markers to mirror genuine user browsers.
Want to see more details on how Orca powers parallel AI coding agents, worktree isolation, and agent browser automation? Check out our open-source repo!