Why does ApiFlash return a 401 error, and how do I fix it?
ApiFlash’s 401 means its access key is invalid or revoked. Check where your request sends the key, then replace it with a current key from your dashboard.
ApiFlash returns a 401 when the access key in the request is invalid or has been revoked. Check that your request includes a current access_key in the right place: the query string for GET requests or form data for POST requests. If the key is stale or revoked, replace it with a valid key from your ApiFlash dashboard and update the application configuration.
1. Confirm the response is really a 401
Start with the HTTP status and response body. ApiFlash assigns different meanings to nearby error codes, so a quota, plan, or rate-limit problem needs a different fix.
| Status | Documented meaning | What to check |
|---|---|---|
| 400 | Invalid API parameters, or the target URL cannot be captured. | Review the parameters and target URL. ApiFlash says the response includes an error message. |
| 401 | The access key is invalid or revoked. | Verify the current dashboard key and how the request sends it. |
| 402 | The monthly screenshot quota has been exceeded. | Check account quota and plan. |
| 403 | A requested feature is not supported by the current plan. | Check the feature and plan. |
| 429 | Too many API calls. | Check request volume and the response body’s reason. |
These meanings are documented by ApiFlash’s API documentation. Do not apply the 401 key fix to a response with a different status.
2. Check the authentication parameter and method
ApiFlash documents the access_key parameter as the credential for its screenshot endpoint, https://api.apiflash.com/v1/urltoimage. The documented placement depends on the HTTP method:
- GET: include
access_keyin the query string. - POST: include
access_keyas form data.
Do not assume a bearer-token authorization header is the documented authentication method for this endpoint. Compare your request with the matching example below.
GET with cURL
curl -G "https://api.apiflash.com/v1/urltoimage" \
--data-urlencode "access_key=YOUR_APIFLASH_ACCESS_KEY" \
--data-urlencode "url=https://example.com" \
-o screenshot.pngReplace the placeholder with a current key from your dashboard and use the target page you want to capture. Keep the key out of shell history where your environment or workflow makes that possible.
POST with cURL
curl -X POST "https://api.apiflash.com/v1/urltoimage" \
-F "access_key=YOUR_APIFLASH_ACCESS_KEY" \
-F "url=https://example.com" \
-o screenshot.pngThis sends the credential as form data, as ApiFlash documents for POST. If your integration uses another HTTP client, preserve the same method and parameter placement.
3. Replace a stale or revoked key
- Open the ApiFlash dashboard and locate the current API key. ApiFlash’s FAQ says keys are created at signup and managed from the dashboard.
- Compare the configured value with the current dashboard key. Make sure the running application is configured with that key, not an older one.
- If the current key is invalid or revoked, replace it in the dashboard or use a valid key available to the account.
- Update the application or deployment configuration that supplies
access_key, then retry the same request. - Check the returned status again. If it is no longer 401, use the new status and response body to diagnose any remaining issue.
The documentation establishes that the key must be valid, but it cannot identify which configuration source your application reads. Inspect the request your code actually sends and the configuration for the environment making the call.
4. Keep the key out of public client code
A key in a URL can be exposed wherever request URLs are logged or inspected. Avoid placing a long-lived API key in browser code that visitors can read. ApiFlash’s guides index includes proxy and Cloudflare Worker approaches for hiding a key; these are deployment choices, not prerequisites for fixing a 401.
For server-side applications, store the key in the appropriate private application configuration and send the request from the server. For a browser-facing integration, route requests through a server or worker you control rather than exposing the credential to the browser. Do not share a key in a public issue or log.
Optional secrets-management tooling can help teams manage credentials across environments, but ApiFlash’s documentation does not require or endorse a particular service.
5. Troubleshoot the remaining 401
| Symptom | Likely check | Next step |
|---|---|---|
| The request still returns 401 after changing configuration. | The running process may still be using a different configured value. | Inspect the actual outgoing request and update the configuration source used by that deployment. |
The request has no access_key parameter. |
The credential was omitted or placed somewhere the endpoint does not document. | Send it in the GET query string or as POST form data. |
| You changed the key but the error remains. | The replacement may not be the current valid dashboard key, or the request may still use the old value. | Compare the outgoing credential configuration with the dashboard and retry. |
| The status is 400, 402, 403, or 429. | This is a different documented error category. | Use the status table above: inspect parameters or target URL for 400, quota for 402, plan features for 403, and call volume for 429. |
The official materials reviewed define 401 as an invalid or revoked key. They do not establish whitespace, browser cache, IP allowlisting, billing, or temporary outages as causes of this status, so do not assume those explanations without additional evidence.
6. Reliability and cost considerations
A 401 is an authentication rejection, so retrying the same request unchanged will not correct an invalid or revoked key. Fix the credential or its placement first. Once authentication succeeds, separately handle other response codes using their documented meanings.
ApiFlash’s 402 quota response is distinct from 401. Check quota only when the API returns 402; a 401 calls for checking the key. Similarly, a 429 indicates too many API calls, not an invalid credential. This keeps remediation focused and avoids unnecessary retries.
Or skip the browser setup
If your goal is simply to get a website screenshot without managing a browser capture stack, ScreenshotNeo is a website screenshot API and MCP server. One GET request returns an image or PDF. It is a separate service and does not repair an ApiFlash key.
For a quick API call, see the ScreenshotNeo documentation:
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpScreenshotNeo accepts cookie and consent banners like a visitor, then removes 60+ known consent platforms, newsletter popups, and chat widgets before capture; each step can be turned off. Bot checks, blank pages, failed loads, timeouts, and cache hits are not billed, and response headers identify the page verdict and billing status. Its MCP server gives AI agents tools to take screenshots, get page information, and capture PDFs. The free plan includes 1,000 screenshots a month with no card; paid plans start at $5 for 3,000 screenshots.
Sign up for 1,000 free screenshots a month, with no card required.
FAQ
Does an ApiFlash 401 mean I exceeded my screenshot quota?
No. ApiFlash documents 402 for an exceeded monthly quota. Its documented 401 meaning is an invalid or revoked access key.
Can I send the ApiFlash key as a bearer token?
The endpoint documentation specifies the access_key parameter: query string for GET and form data for POST. Use that documented mechanism.
Where do I get or manage an ApiFlash key?
ApiFlash says keys are available and manageable in the dashboard; its FAQ says signup creates a key.
Should I set up a proxy to fix the error?
No. A proxy or Cloudflare Worker can help keep a key hidden in a browser-facing integration. The direct 401 fix is to send a valid key in the documented location.
