In Multilogin, profile password protection lets you restrict actions on browser profiles, such as starting, cloning, moving, or updating them. This helps you control changes when multiple team members work with the same profiles.

➡️ This feature is available through the API only. To set it up in Postman, go to “Collections” → “Multilogin API” → “Profile Management” → “Set Profile Password”.

You can choose which actions require a profile password and use a profile authentication token to authorize supported requests.

How does a profile password work

Profile password protection lets you choose which API actions require additional authentication.

When you protect a profile, users must authenticate with its password before performing the selected actions. The “Log in Profile” API request returns a profile authentication token that you can include in supported requests.

Only the actions selected in the restricted field require this additional authentication. The “Profile Move” request uses a different method, described below.

Important: If you don't specify any restrictions, all supported actions are restricted by default.

To restrict only certain actions, include their keys in the restricted field. For example, use profile_update if you only want to restrict profile updates.

What does password protection restrict

Before you start

You'll need:

• API or automation token: authenticates your request to the Multilogin API. In Postman, enter it under “Authorization” → “Bearer Token”.
• Profile authentication token: authorizes selected actions on a password-protected profile. Generate it using “Log in Profile”, then include it in the X-Profile-Authentication header when required.
• The ID of the browser profile you want to protect
• Postman with the Multilogin API collection

If you don't have these yet, follow these guides:

• How to get your Multilogin API token
• How to get your Multilogin automation token
• How to copy profile IDs in Multilogin

You'll use your API or automation token to authorize requests in Postman. Some protected actions also require a separate profile authentication token.

How to set the password

Step 1: find the API request

1. Go to the “Collections” → “Multilogin API” folder
2. Go to “Profile Management” folder
3. Open POST Set Profile Password to configure the request

4. From the “Params” tab, proceed to “Authorization”
5. Select “Bearer Token” as the Auth Type
6. In the “Token” field on the right, paste your previously copied API token

Step 2: copy the profile ID

Refer to the info from the following article: How to copy profile IDs in Multilogin. It is needed to protect your profile.

Step 3: edit the request and send it

1. Go to the Body tab and edit the parameters:
   1. profile_id: the ID of the profile you copied in the previous step
   2. password: the password of the profile. It should have at least 7 characters, at least one uppercase letter, one number, and one special character
   3. confirm_password: type the same password here
   4. restricted: 
      1. profile_move: restricts the option to move profiles to the other folder. Related to the endpoint POST Profile Move
      2. profile_clone: related to POST Profile Clone
      3. profile_start:  related to GET Start Browser Profile
      4. profile_export: related to POST Profile Export and POST Cookie Export
      5. profile_update: related to POST Profile Update and POST Profile Partial Update
      6. profile_data_change: restricts importing cookies. Related to POST Cookie Import 
         

         You can choose which actions to block – it’s totally up to you. For example, if you only want to block profile updates, just add the profile_update option and leave out the rest. But if you remove everything from the ‘restricted’ section, then all restrictions will be turned on by default.

          
2. Click “Send”

How to receive a profile authentication token

After you set the password, you (and other users who you want to share your profile with) have to generate a special token, which is related to that password. Follow the steps below to know how. 

Step 1: find the API request

1. Go to the “Collections” → “Multilogin API” folder
2. Go to “Profile Management” folder
3. Open POST Log in Profile to configure the request

4. From the “Params” tab, proceed to “Authorization”
5. Select “Bearer Token” as the Auth Type
6. In the “Token” field on the right, paste your previously copied API token
    

Step 2: copy the profile ID

Refer to the info from the following article: How to copy profile IDs in Multilogin. You’ll need the profile ID to get your token – the token is linked to that specific profile.

Step 3: edit the request and send it

1. Go to the Body tab, edit the parameters:
   1. password: The password of the profile. It is the one, which you (or the other user) have set in the POST Set Profile Password endpoint
   2. profile_id: The ID of the profile you copied in the previous step
2. Click “Send”

Step 4: copy the token from the response body

Copy everything in the token, except the quotation marks. That will be your token. You will need it for executing requests on the password-protected profile.

How to run a request for a password-protected profile

After you set the password and receive a token from the “Log in Profile” request, you can run some “sensitive” API requests. Not all endpoints require the token, only those that are mentioned in the “restricted” list. The list is the following:

• POST Profile Move
• POST Profile Clone
• GET Start Browser Profile
• POST Profile Update
• POST Profile Partial Update 
• POST Cookie Export
• POST Cookie Import
• POST Profile Export

Step 1: find the API request you'd like to run

You need to determine which endpoint from the list above you would like to use. GET Start Browser Profile endpoint will be used for reference in this guide. The location of the request, parameter, and endpoint bar values may differ. 

Step 2: edit the values of your request

In our case – follow the “Before you start” steps from the following article: How to start a Multilogin profile with Postman.

Step 3: add the profile authentication token header

1. Copy the token mentioned in the following chapter: How to receive profile authentication header
2. Go to “Header” tab and click the empty Key value

3. Fill the empty Key field with the following value: X-Profile-Authentication
   

4. Fill the “Value” field with your token. 

Step 4: click “Send” button

After all the preparations, you can execute the request to password protected profile.

How to run Profile Move request

POST Profile Move request processing is mostly the same as other endpoints, except one caveat related to request body. 

Step 1: replace the default request body with a password-protected one

1. POST Profile Move request body will look something like this:
    

2. Replace it with other request body, which has password parameter. You can refer to the body in the API documentation or copy and paste it from the form below:

   {
       "dest_folder_id": "{{FolderCreateID}}",
       "profiles": [
           {
               "profile_id": "{{ProfileMimic}}",
               "password": "{{ProfilePassword}}"
           }
       ]
   }

1. Replace the values of parameters:
   1. dest_folder_id: the folder ID you would like to transfer your profile. You can get it by following the following article: How to get profile, folder, and workspace IDs in DevTools
   2. profile_id: the profile ID itself, which you got in previous step
   3. password: password which you used for protecting your profile 

Step 2: click “Send” 

If you configured everything correctly, the profile will be moved to the other folder.

How to remove a password 

If you do not need to protect your profile any more, you can remove a password. Here's how you can do it. 

Step 1: find the API request 

The step is the same as Step 2 from How to run a request for a password-protected profile. In this case, the request POST Remove Password is located in the “Profile Management” folder.

Step 2: edit the values of your request

You need to add your profile ID value. You can find it by following the article: How to copy profile IDs in Multilogin.

Step 3: add your API token and click “Send”

1. From the “Params” tab, proceed to “Authorization”
2. Select “Bearer Token” as the Auth Type
3. In the “Token” field on the right, paste your API token

1. Click “Send” button

FAQ

Why does Postman return “Wrong JWT token”?

Your regular API token may have expired or be incorrect. Regular API tokens expire after 30 minutes.

Get a new token or use a valid automation token, then check “Authorization” → “Bearer Token”.

Why do I get “Missing authorization header”?

Check that your regular API token is included in “Authorization” → “Bearer Token”.

For requests that require profile authentication, also check the X-Profile-Authentication header.

Why can't I perform a restricted action?

Check that you're using the correct profile ID, that your workspace role allows the action, and that you've included the required profile authentication credentials.