The Appy Pie AI app builder alternative where the agent signs in as you, using cookies from the Chrome you already use.

Nothing. Appy Pie is a no-code template builder. The app you get is generated from templates, published to Play and the App Store, and has no browser of its own and no way to import your browser identity from anywhere else. If you need an AI app that can act as you on sites you already use, a template builder is the wrong category.

Whatever cookies the paired browser extension decides to send, sanitized on arrival. The ingest route at src/app/api/cookie-bridge/ingest/route.ts lines 85 to 101 keeps only name, value, domain, path, secure, httpOnly, sameSite, and expires. Other fields are dropped. Up to 2000 cookies per request (MAX_COOKIES_PER_REQUEST in src/lib/cookie-bridge.ts line 8).

Inside the E2B sandbox, the ACP bridge exposes POST /inject-cookies on port 3002 (src/core/vm-scripts.ts line 747). It opens a WebSocket to Chromium's browser-level CDP (GET http://127.0.0.1:9222/json/version, read webSocketDebuggerUrl, connect the WS), then issues Storage.setCookies. It tries a batch first; if the batch is rejected it falls back to per-cookie setCookies so one bad cookie does not sink the rest. See src/core/vm-scripts.ts lines 352 to 420.

Three layers. First, pair requires an authenticated web session and an ownership check on the sessionKey (src/app/api/cookie-bridge/pair/route.ts lines 22 to 44). Second, the 8-character pairing code lives in Firestore for 10 minutes and is redeemable exactly once: the redeem endpoint runs a Firestore transaction that marks redeemedAt (src/app/api/cookie-bridge/redeem/route.ts lines 37 to 75). Third, the returned bearer token is never stored plaintext. Only its SHA-256 hash lives in cookie_bridge_tokens, and the token rotates every 24 hours (src/lib/cookie-bridge.ts lines 28 to 36).

Every ingest call has to match both its bearer token and the sessionKey in its body. The route looks up the token's hash in Firestore, verifies the sessionKey is the one bound at redeem time, and also verifies session ownership if the session already belongs to a user (src/app/api/cookie-bridge/ingest/route.ts lines 56 to 83). Mismatches return 401 or 403.

The cookies go into the browser-level cookie store of the one Chromium running inside the VM, so every tab the agent opens there inherits them. The agent uses the same Chromium for Playwright automation, so an agent task like 'open app.notion.so and screenshot the kanban' runs with your logged-in state present. The in-VM server cannot see the actual cookie values after the fact, they live in Chromium.

Storage.setCookies with the CDP param shape built by toCdpCookieParam in src/core/vm-scripts.ts lines 335 to 350: name, value, domain, path, optional secure, httpOnly, sameSite normalized to None/Strict/Lax, and expires as a number. One WebSocket connection per ingest call, closed as soon as the batch (or per-cookie fallback) returns, with a 60-second overall timeout.

The bearer token expires after 24 hours by default (TOKEN_TTL_MS in src/lib/cookie-bridge.ts line 7). Deleting the row in Firestore's cookie_bridge_tokens collection invalidates it immediately. Re-pairing mints a new token bound to a new sessionKey.

You need to be signed in on the web app to mint a pairing code (the pair route calls requireAuthOrError). You do not need an Appy Pie style email capture to try the builder itself; the anonymous path mints a browser UUID and boots a sandbox without credentials. Cookie bridging is the one feature that cares about identity, because it is moving your real browser state into the VM.