API keys and authentication

Create and manage API keys

Create an API key in your ScreenshotEngine dashboard. Save it in an environment variable such as SCREENSHOTENGINE_API_KEY or your deployment platform’s secret storage. Use a real account key for your integration.

POST: Authorization header

For POST /v1/screenshot, send Authorization: Bearer YOUR_API_KEY and Content-Type: application/json. Put capture options in the JSON body. An api_key field in that body does not authenticate the request.

curl --fail-with-body --request POST 'https://api.screenshotengine.com/v1/screenshot' \
  --header "Authorization: Bearer $SCREENSHOTENGINE_API_KEY" \
  --header 'Content-Type: application/json' \
  --data '{
  "url": "https://example.com",
  "format": "png"
}' \
  --output screenshot.png

GET: api_key query parameter

For GET /v1/screenshot, include api_key in the query string. The GET request schema requires it, so a Bearer header alone is not a substitute. Do not publish URLs containing your key in public HTML, repositories, or client-side JavaScript.

https://api.screenshotengine.com/v1/screenshot?url=https%3A%2F%2Fexample.com&api_key=YOUR_API_KEY

Integrating with a browser application

Call ScreenshotEngine from your backend and return the resulting file to your frontend. A key embedded in a React component, a public environment variable, or an image URL can be read by visitors.

If a key is exposed, create a replacement in the dashboard, update your server configuration, and revoke the old key. Avoid logging Authorization headers or query strings containing api_key.

Can I capture a page behind a login?

The documented screenshot endpoint accepts a public URL. It does not expose options for custom cookies, target-site Authorization headers, or login scripts. Your ScreenshotEngine API key authenticates the API call; it does not sign in to the website being captured.