Scraping behind a login is not research

If you needed a password, you are in a different job than a public-page note. Behind-login collection is not research. It is access. Sometimes that access is authorized and already has an export. Sometimes it is someone else's mailbox. The password does not make a harvest ethical. It makes the ethical bar higher.

What web scraping is already drew this line. This URL exists because tutorials still treat "log in, then parse" as a beginner chapter.

Why the password changes the job

A public page is offered to whoever arrives. A login is offered to an account. Cookies after that login are a live key. Collecting the tree behind that key is collecting as that account, at machine pace, often against terms that already forbade automation.

Personal data and collection is the privacy sibling. Inboxes, customer lists, messages, and stored payment views sit behind doors for a reason. I will not write the parse.

We will not scrape LinkedIn inboxes is the commercial application. Official API and public pages only. A headed session that pages through InMail is the refused job.

A password is a grant to a person or to an official app, not to every script on the PC. The grant is scoped. Inbox, billing, customer PII, and draft creatives sit in that scope. Machine-paging those trees is using the grant as a firehose. Terms usually already said no.

What authorized access still looks like

You already run the account. The product has an export button or an official API. You pull the report as the business, store it off the work profile, and stop. That is not scraping the UI. That is using the door.

Facebook Ads Library research locally stays on the public catalog. Ads Manager exports stay in the entity profile as operator work, not as a collector attach.

Playwright for pages you own is the other authorized case: your staging host, your shop, your login on a property you control. MaskWright does not ship Playwright. The driver lives in a scripts folder pointed at your host, not at someone else's inbox.

What I skip

A cookie paste into a collector so the script "is you." An honest research UA does not cover that. User-agent honesty in research. You are not a research client. You are a stolen or borrowed session.

A work-profile attach. Scripts stay outside work profiles. A live cookie store is not a test fixture.

A hide so the site thinks a person is paging the inbox. We will not hide a scraper. An anti-bot wall on that path is a stop, then a search for the official channel. Anti-bot pages and official channels.

A "research only" label on a customer CSV you were not given an export for.

Authorized export versus a UI harvest

An export button or a scoped API call is the business pulling its own file. You can name the entity. You can point at the docs. You can store the leftover off the work profile with a provenance line.

A UI harvest is a program walking the same screens a person uses, after a login, because the export was missing or narrow. That is the chapter the 2023 tutorials loved. It is also how customer data lands in a folder that was supposed to hold public notes. If the official door is narrower than you wanted, you shrink the job or you ask the vendor. You do not parse the inbox.

Local notes

MaskWright stores cookies in the profile and can import Netscape or JSON. Import is for a backup you hold, applied at launch. The on-disk import file is plaintext. That fact is a warning, not a pipeline. Do not feed the import to a harvester.

Storing research files. Inbox HTML does not belong in the research folder. Official exports do, with provenance.

If the only way to see the bytes is to sign in, and there is no official export, you read as a person or you do without. Those are the honest options. A person reading their own inbox is still a person. A program paging that inbox is a harvest, even when the login is yours.

The Scraping hub will keep repeating the sentence in the title. Behind a login is access. Research is the public door, the official feed, or a host you own.

FAQ

I own the account. Why can't I scrape my own inbox?

You can read it as a person, and you can use an official export if the product ships one. A program paging the UI is still a harvest, and terms often already said no. Ownership of the login is not a blank check for a parser.

Can I import cookies into a collector?

Import is for a backup you hold, applied to a profile you sit in. It is not a boarding pass for a harvester.