Signed requests

To embed a screenshot directly in a browser (an <img> tag, for example) without exposing your secret key, use a signed request. You send the public access key (the key's id) plus a signature computed on your server with the signing secret. Both are shown once when you create a key.

How it works

The signature is the hex HMAC-SHA256 of the canonical query string — every query parameter except signature, sorted by name and joined as key=value&…. Because the signature covers every parameter, a signed URL only ever produces that one exact screenshot; changing any value invalidates it.

Example

import crypto from "crypto";

const params = {
  url: "https://example.com",
  format: "png",
  full_page: "true",
  access_key: "<access_key>",
};

const canonical = Object.keys(params).sort().map((k) => `${k}=${params[k]}`).join("&");
const signature = crypto.createHmac("sha256", SIGNING_SECRET).update(canonical).digest("hex");

const src = `https://screenshotforweb.com/api/v1/screenshot?${new URLSearchParams({ ...params, signature })}`;
// <img src={src} />  — the secret never reaches the client

Use signed requests for anything rendered client-side. For server-to-server calls, just send your secret key as a header — see Authentication.