First check
🧩 Extension detected?
Load the official helper and handle EXT_NOT_DETECTED with a clear user message.
❓ FAQ & troubleshooting
Answers for installing, detecting and safely using Remote Tab Opener.
Start here when something does not behave as expected. Most RTO issues become simple once you check the extension, the allow-list, the tab key and the selector in the right order.
👁️ See it first
Watch the live simulation before installing anything
The simulator shows visible controlled tabs, the warning bar, the RTO overlay and the master tab receiving results — no extension required for the demo.
🩺 Fast diagnosis path
Check these three things first
Second check
✅ Host allow-listed?
RTO is deny-by-default. A page can ask for approval, but the extension keeps the final decision visible.
Third check
🎯 Stable tab or selector?
Use stable tabKey values, wait before acting, and prefer predictable selectors.
Website policy
🔒 RTO Lock published?
A site can publish rto-lock.json to state where active RTO commands are welcome or refused.
🚀 1. Installation
Install the extension, then allow only the hosts you trust
🧩 How do I install it?
Install the extension, keep it enabled, then approve only the hosts you actually want RTO to control.
🏠 Do I need a backend?
No. Your page talks to the extension through a local browser bridge. There is no proxy, no server-side browser and no cookie interception.
🔎 2. Detect
Detect the extension before trying to control anything
Use the official helper API and show a friendly message if the extension is missing.
<script src="/RTO_helpers/RTO_form_api.js"></script>
<script>
RTOForm.detect(2000)
.then(function(info){
console.log("RTO OK", info && info.version ? info.version : "");
})
.catch(function(err){
var code = err && err.code ? err.code : "EXT_NOT_DETECTED";
console.warn("RTO not available:", code);
});
</script>✅ 3. Allow-list
Real targets require explicit approval
🛑 Deny by default
The target host must be explicitly allowed before controlled actions run. Otherwise commands are rejected with DOMAIN_NOT_ALLOWED.
👤 User decision
Page-side approval requests use allowlistAddRequest, so the user sees and confirms the decision. Direct page-side self-approval is intentionally not the public path.
🧭 4. Tabs
Use tab keys to control visible browser tabs predictably
Use tabKey to consistently target a named tab across the same workflow. In v8.3.3, openTab is serialized per key, so opening the same tabKey twice reuses the controlled tab instead of racing into duplicates.
<script src="/RTO_helpers/RTO_form_api.js"></script>
<script>
var tabKey = "auth";
RTOForm.openTab({ "tabKey": tabKey, "url": "https://example.com/login", "focus": true }, { "timeoutMs": 20000 })
.then(function(){
return RTOForm.focusTab({ "tabKey": tabKey }, { "timeoutMs": 4000 });
})
.then(function(){
return RTOForm.getUrl({ "tabKey": tabKey }, { "timeoutMs": 8000 });
})
.then(function(res){
var data = res && res.data ? res.data : res;
console.log("Current URL:", data && data.url ? data.url : "");
})
.catch(function(err){
console.warn("Tab flow failed:", err && err.code ? err.code : err);
});
</script>🎯 5. DOM actions
Wait first, then act on documented commands
DOM actions run inside the controlled tab through documented commands. Wait before acting and never log real secrets.
<script src="/RTO_helpers/RTO_form_api.js"></script>
<script>
var tabKey = "auth";
RTOForm.waitForSelector({ "tabKey": tabKey, "selector": "#email" }, { "timeoutMs": 10000 })
.then(function(){
return RTOForm.setValue({ "tabKey": tabKey, "selector": "#email", "value": "user@example.com" }, { "timeoutMs": 8000 });
})
.then(function(){
return RTOForm.click({ "tabKey": tabKey, "selector": "button[type='submit']" }, { "timeoutMs": 8000 });
})
.catch(function(err){
var code = err && err.code ? err.code : "ERROR";
if(code === "ELEMENT_NOT_FOUND") console.warn("Selector not found — update selector or wait longer.");
else console.warn("DOM action failed:", code);
});
</script>🧯 6. Errors
Common errors and what they usually mean
| Error | Meaning | Common fix |
|---|---|---|
EXT_NOT_DETECTED | The extension is not installed, disabled, or not responding. | Show an install or enable message, then retry RTOForm.detect(). |
DOMAIN_NOT_ALLOWED | The target host is not in the allow-list. | Ask the user to approve the host in the extension UI. |
NO_CONTROLLED_TAB | No tab matching the requested tabKey is under control. | Open, reuse, or adopt the tab again; verify the host is allowed. |
ELEMENT_NOT_FOUND | The selector did not match an element. | Use a stable selector and call waitForSelector first. |
TIMEOUT | No response arrived within the configured time. | Increase timeout, confirm navigation, and add intermediate waits. |
🛡️ 7. Safety
Direct safety answers
🧱 Does RTO bypass browser security?
No. RTO works through extension permissions, controlled tabs and allow-list checks. It does not bypass the Same-Origin Policy.
🔑 Why broad permissions?
Tab management and allowed-host actions require access to real tabs. Useful control remains explicit, visible and allow-listed.
👻 Can a page control my browser silently?
No. A page may ask through the bridge, but hosts must be allowed and direct page-side self-approval is not the public path.
🏠 What data leaves my browser?
The RTO bridge is local-first. Commands and results stay in the browser unless the integrating website independently sends its own data elsewhere.
🔒 8. RTO Lock
Website owners can publish safety rules
rto-lock.json is the website owner's public instruction file for RTO.
It tells RTO which families of commands are acceptable on that site and which ones must be refused. A site can allow harmless visible workflows on public pages while blocking active automation on login, account, checkout, payment, admin, identity, healthcare or private user areas.
The policy can apply to the whole site, to specific path prefixes, or to subdomains only when inheritance is explicitly enabled. RTO checks those published limits before active commands, so website policy and local user approval work together.
View the RTO Lock guide🔐 9. Privacy
Privacy and security basics
🏠 Local-first
Commands and results stay in the browser.
✅ Deny-by-default
The allow-list is required for cross-domain control.
🚫 No arbitrary code execution
RTO exposes documented tab and DOM commands, not an open JavaScript execution channel.
🍪 No cookie interception
RTO is not a proxy and does not need to read cookies to work.
💡 10. Best practices
Small habits that prevent most problems
🧩 Detect first
Start with detect, then show a clear status UI.
🏷️ Name tabs clearly
Keep one stable tabKey per target role, such as auth, monitor, or ops.
⏱️ Wait before acting
Use waitForSelector before click, setValue, or extraction.
🔒 Treat values as sensitive
Never print secrets, and use helper files when you want a stable, paste-ready integration path.