Gaffa
Gaffa is a REST API for driving real cloud browsers: one call combines a URL with an ordered list of actions. It returns markdown, structured JSON, screenshots or PDFs, for developers, data teams and AI agent builders.
What is Gaffa?
Gaffa is a REST API for browser automation published by Impetus Labs Ltd., a London company. Its documentation presents it as an API that lets you control real web browsers at scale through a simple interface with no configuration required: you tell it which site to visit and which actions to perform, and it returns the result. The browsers are real cloud browsers rather than headless ones, which the publisher argues render JavaScript sites exactly as a local machine would, are harder to detect when scraping, and allow full observability. A browser request has three parts. Parameters set the target (url, proxy_location, async, max_cache_age). Settings control the run (record_request for video capture, max_media_bandwidth, time limits). Actions form an ordered list executed in submission order; a failure aborts the request unless continue_on_fail is set to true, and every action accepts the universal parameters continue_on_fail and custom_id. Seventeen actions are documented. Five produce no output (block_dom_removals, click, scroll, type, wait) and twelve return data: capture_cookies, capture_dom, capture_element, capture_screenshot, capture_snapshot, download_file, generate_markdown, generate_simplified_dom, loop, parse_json, parse_table and print. Together they yield simplified HTML, LLM-ready markdown, screenshots, PDFs, structured JSON and a self-contained offline copy of a page. A second request family, mapping requests (POST v1/site/map), discovers a sitemap automatically, traverses sitemap indexes, deduplicates and alphabetically sorts the URLs, shares a cache between users and caps at 60 seconds. Reusable schemas have their own endpoints, and authentication uses a single X-API-Key header, with keys created and revoked from Dashboard > API Keys. For sites with strong anti-bot defences, a Stealth layer combines proxies, human-like behaviour, captcha solving and an in-house browser implementation; residential proxies are enabled through the proxy_location parameter. Onboarding tooling includes an API Playground with five prebuilt examples, a public page simulator at demo.gaffa.dev, and llms.txt and llms-full.txt files so an AI assistant can write the calling code, with documentation hosted on GitBook. The audience is developers, data teams and AI agent builders who need web data without operating a browser fleet. The publisher acknowledges that Gaffa is currently in its very early stages.
What it does
- Drive a real cloud browser through a single POST to v1/browser/requests, combining a URL with an ordered list of actions
- Scrape JavaScript-rendered sites, with JS rendering applied by default
- Convert any page into LLM-ready markdown or a simplified DOM
- Extract structured JSON from prose, PDFs or messy layouts, and pull rows out of HTML tables
- Capture full-height screenshots, or print a page to PDF with chosen size, margin and orientation
- Fill in and submit forms with human-like clicking, typing, scrolling and waiting
- Retrieve every URL in a site's sitemap with one mapping request, and route traffic through country-selectable residential proxies
When to use Gaffa / When not to
A quick filter to help you decide if Gaffa is the right fit.
When to use Gaffa
- Backend and full-stack developers who need to scrape JavaScript-rendered sites without maintaining browser infrastructure, proxies or a Playwright, Selenium or Puppeteer stack.
- Data engineering teams ingesting web content into a warehouse or an ETL pipeline, using mapping requests to enumerate a site's URLs before extraction.
- AI agent builders: the publisher states it wants to support the development of AI agents able to use the internet exactly how humans would.
- LLM and RAG application developers, who can turn any page into LLM-ready markdown or a simplified DOM with a single action.
- Startups and small technical teams, addressed by a plan literally named Startup and by four published case studies: job-board aggregation (ivee), a universal news plugin (TRMNL), access to policy pages that block AI agents (Chayn Survivor AI) and web-to-PDF reporting (SailSys).
When not to use Gaffa
- Non-technical users looking for a no-code interface: everything goes through HTTP requests and hand-written JSON payloads.
- Teams that expect an official SDK or client library, since the publisher ships raw REST only, with no announced language bindings.
- Anyone wanting a mobile app, a browser extension or a plugin: the product is an API plus a web dashboard, nothing else.
- Users who need immediate, high-volume open-web automation: a paid plan is required beyond the free credits, new accounts join a queue, concurrency is capped at 1, 3 or 10 simultaneous requests and each request at 1, 2 or 5 minutes depending on the plan, with mapping requests stopping at 60 seconds.
- Organisations with a formal vendor-security checklist: no DPA is published, no SOC 2 or ISO 27001 certification is claimed, and there is no trust or security page.
How to use Gaffa
A typical end-to-end flow, from setup to results.
- Create an account on gaffa.dev/sign-up: 500 credits are granted, with no credit card required
- Try the API Playground in the dashboard, starting from one of its five prebuilt examples
- Practise on the public page simulator at demo.gaffa.dev before targeting live sites
- For open-web automation, choose and pay for a plan, then join the queue when prompted on your account dashboard
- Optionally move ahead in that queue by completing the publisher's short user questionnaire
- Create an API key in Dashboard > API Keys and copy its value
- Authenticate every call with the X-API-Key header
- Send a POST to v1/browser/requests with url, proxy_location, async and max_cache_age, plus a settings block containing the ordered actions
- Read the result synchronously (async set to false) or poll GET v1/browser/requests/{id}
- For a full URL list, send a POST to v1/site/map with url and max_cache_age; optionally feed llms-full.txt to an AI assistant so it writes the calling code for you
Pros & Cons
Pros
- Zero configuration: no framework, no proxy setup and no browser infrastructure to operate
- A single REST API, callable from any language able to issue an HTTP request
- Real browsers rather than headless ones: faithful rendering and lower detectability when scraping
- Outputs designed for direct LLM consumption, with markdown, structured JSON and simplified DOM
- Residential proxies included on all three plans, with the exit country chosen by parameter
- A genuine trial: 500 credits granted without a credit card, usable on the open web and not only on the demo site
- Substantial documentation, with tutorials, endpoint reference, playground examples, an action-choice table and llms.txt files, plus video recording of runs for debugging
Cons
- A young product, acknowledged as such by the publisher, which writes that Gaffa is currently in its very early stages; new accounts must also join a queue before getting open-web access
- Published pricing is inconsistent on proxy bandwidth: the homepage FAQ bills 750 credits per GB, while the credits and pricing documentation bills 1,500 credits per GB
- Refund conditions are stated twice and differently: a 7-day window after the subscription starts in the refund policy, versus not having used any credits in the current month in the homepage FAQ; refunds are in any case not guaranteed and granted at the publisher's sole discretion
- No DPA is published, no security certification such as SOC 2 or ISO 27001 is claimed, and there is no trust or security page; the subprocessor list names a single company, Stripe, and is introduced by the word include, so it is not exhaustive
- Tight operational ceilings: 1, 3 or 10 concurrent requests and 1, 2 or 5 minutes per request depending on the plan, and 60 seconds for a mapping request
- Unused credits are lost at each billing cycle, with no rollover
- No SDK or client library, no published SLA and no status page, with a team reduced to one named individual, Claude AI and GitHub Copilot being presented as the other team members
Pricing & Plans
No permanently free plan is advertised in the pricing grid. Every new account receives a one-off allocation of 500 credits, granted without a credit card. The lowest paid entry point is the Starter plan at USD 29.00 per month. Credits may also be purchased outright, without a subscription, at USD 20.00 for 5,000 credits, and a bespoke plan is available on request through the contact page.
- browser request API
- 9
- 000 credits
- 1 concurrent request
- 1 minute maximum per request
- 7-day data retention
- residential proxies
- browser request API
- 35
- 000 credits
- 3 concurrent requests
- 2 minutes maximum per request
- 30-day data retention
- residential proxies
- browser request API
- 100
- 000 credits
- 10 concurrent requests
- 5 minutes maximum per request
- 3-month data retention
- residential proxies
- one-off purchase
- on its own or on top of a plan
- with the same allowances as the Starter plan
- a custom plan built on request through the contact page
- with no published price
- 10
- 000 credits correspond to roughly 3
- 333 typical browser sessions
- about 28 browser hours and 8.5 GB of proxy bandwidth
Data, GDPR & hosting
A consolidated view of how Gaffa handles your data.
GDPR overview
The privacy policy, effective 20 August 2024, contains two dedicated sections: EU GDPR and UK GDPR. Impetus Labs Ltd. describes itself as data controller and/or processor, and states it remains compliant with its data controller obligations. Legal bases listed are consent, contract performance, legitimate interests and legal compliance; parental consent is required below 16. Rights covered include access, rectification, erasure, restriction, objection, portability in CSV, information and non-discrimination, with a 30-calendar-day response deadline. Transfers outside the EEA rely on European Commission standard contractual clauses and binding corporate rules; UK GDPR Article 45 and the Data Protection Act 2018 are cited. The Information Commissioner's Office is named as supervisory authority, with full address and telephone. A Data Protection Officer is mentioned but has no dedicated email, and no EU Article 27 representative is appointed. No certification or external audit is claimed.
Who owns the data?
The terms of service cover only the site's own materials, owned by or licensed to Impetus Labs Ltd., with a revocable licence to download one copy for personal, non-commercial, transitory use. The Acceptable Use Policy makes the customer solely responsible for all material they input, upload, transmit, create or publish through the products, and for obtaining legal permission to use it. The privacy policy positions Impetus Labs as data controller and/or processor for personal information, and a Business Transfers clause would pass personal data to an acquirer or treat it as an asset in insolvency. No clause states who owns the data extracted from third-party pages by browser requests, which is a documented gap.
Reuse rights
The site's own materials may be used for personal, non-commercial, transitory purposes only: modifying, copying, creating derivative works, decompiling, reverse-engineering, removing copyright notices, transferring them or mirroring them on another server is prohibited. For the data a customer extracts through the API, Gaffa states no contractual restriction on reuse; the limits are behavioural rather than proprietary. The terms of service forbid using the service to harvest, collect, or gather user data without the user's consent, or in a way that may infringe the privacy, intellectual property rights or other rights of third parties, and the Acceptable Use Policy forbids transmitting or storing material protected by copyright, trademark or trade secret without authorisation. A fair-use clause allows the publisher to charge additional fees or restrict capacity where usage is judged excessive. UK law governs, with exclusive jurisdiction.
Data retention & training
Hosting summary
The privacy policy states that the personal information collected is stored and/or processed in Ireland, the United Kingdom and the United States, or wherever the publisher, its partners, affiliates and third-party providers maintain facilities. The UK GDPR section narrows this for UK data subjects, stating that the information collected is stored and/or processed in the United Kingdom by the publisher. Cross-border transfers rely on the European Commission's adequacy decision for the United Kingdom, on European Commission-approved standard contractual clauses, on binding corporate rules or on other legally accepted means, with UK GDPR Article 45 and the Data Protection Act 2018 cited. Stripe is the only third party named. Impetus Labs Ltd. is established in London and UK law governs the service. No hosting region is selectable by the customer and no contractual data residency is offered. Note that the domain resolves to 172.67.197.200 on AS13335 (Cloudflare, anycast), which is a CDN node and not evidence of where application data is stored.
Things to keep in mind
Risks and trade-offs to weigh before adopting Gaffa.
- Legal exposure sits with the customer: the Acceptable Use Policy forbids gathering user data without consent and any infringement of third-party privacy or intellectual property rights, and makes the customer solely responsible for the material processed and for obtaining permission to use it
- The stealth features, human-like behaviour, captcha solving and an in-house browser, are built to get past protections that target sites deliberately put in place; judging whether a given use is acceptable is left entirely to the user
- The parse_json action sends page content to a third-party model (gpt-4o-mini), and the site says nothing about what becomes of that content afterwards
- The site never addresses training on customer data: no commitment, no opt-out, no mention at all, so nothing can be assumed either way
- Traffic is routed through third-party residential proxies whose address sourcing is not documented, and video recordings of automations are kept by the publisher for the plan's retention period, from 7 days to 3 months
- Commercial terms leave room for surprises: a fair-use clause allows additional fees or capacity restrictions with no published threshold, refunds are discretionary and stated under two divergent conditions, and unused credits expire at each cycle
- Dependency risk: a very young publisher, a single named individual, no SLA and no status page, plus a Business Transfers clause under which personal data would follow the company to an acquirer or into insolvency
Setup & Integrations
Technical difficulty
Low for a developer, out of reach for a non-developer. The only real prerequisite is being able to send an HTTP POST with a JSON body: nothing to install, no framework and no dependency, and a single X-API-Key header for authentication. The API Playground ships five editable, runnable examples, demo.gaffa.dev provides practice pages, and llms-full.txt lets an AI assistant write the calling code. Two frictions remain: there is no SDK, so every call is hand-written, and building CSS selectors is the user's responsibility. Access to the open web is also gated by a queue for new accounts.
Deployment
Behind Gaffa
Resources
All the official URLs gathered for verification and reference.
Frequently asked questions
What is a credit?
Is there a free trial?
Do unused credits roll over to the next month?
What happens when I run out of credits?
What is the refund policy?
Do I need to learn Playwright, Selenium or Puppeteer?
Can Gaffa handle sites protected by anti-bot systems?
Can I choose the country traffic exits from?
Where is the data hosted?
Is there a mobile application?
Should you pick Gaffa?
Gaffa's value proposition is clear: remove browser infrastructure, frameworks, proxies, scaling and headless browsers behind a single REST API, and return web content in formats a program or a language model can consume directly. Functional coverage is already broad for a young product, with seventeen actions, two request families and outputs ranging from simplified HTML and markdown to structured JSON, screenshots and PDFs. Entry pricing is legible and low at USD 29 per month, credits can be bought on demand, and the 500-credit trial needs no card and works on the open web. Traction signals exist: four customer case studies published between January 2025 and July 2026, sixteen blog posts and participation in Major League Hacking's Global Hack Week. The reservations are equally documented. The publisher itself writes that Gaffa is in its very early stages, new accounts wait in a queue for open-web access, and the visible team is one individual with two AI assistants presented as teammates. No DPA and no security certification are published, the credit rate for proxy bandwidth appears at two different values on two first-party pages, and refund eligibility is expressed under two divergent conditions. Data governance is thorough on the EU and UK GDPR side, but the site is entirely silent on model training and on who owns the data extracted from third-party pages. The natural buyer is a technical team that already has a web-data use case and wants to avoid running its own browser fleet: the trial is large enough to benchmark real pages, and the entry plan is cheap enough to test at small volume. Teams bound by a formal vendor-security process, or needing contractual guarantees on retention, subprocessors or availability, will want to wait for the publisher to document more.
- Choosing a selection results in a full page refresh.
- Opens in a new window.