How to capture screenshots of password-protected pages with CaptureKit

Short answer: CaptureKit’s reviewed documentation does not establish a supported way to log in to a password-protected target website before taking its screenshot. The x-api-key authenticates your request to CaptureKit; it is not the username, password, cookie, or session for the target site. Ask CaptureKit support whether it provides an approved target-session method before building a protected-page workflow.

You can use the documented endpoint for public pages. Its reference describes rendering controls such as viewport and device settings, full-page capture, element selection, waits, and proxy routing, but the reviewed reference does not document target-site cookies, custom headers, a login flow, or browser-session reuse. That is a limit of the documentation reviewed, not proof that CaptureKit has no separately documented or newly added capability. CaptureKit capture endpoint reference

1. Separate the two authentication questions

A screenshot request can involve two different systems:

Calling CaptureKit: your application supplies a CaptureKit API key, documented in the x-api-key header.
Accessing the target page: the website may require its own login, session cookie, authorization header, or other access mechanism.

Having a valid CaptureKit key only answers the first question. If the capture service fetches a protected URL without an authenticated target session, the site may return a login page, an access-denied response, or a redirect. A screenshot of that response is not a screenshot of the private content.

CaptureKit’s API overview and quick start describe calling the service from your backend, automation platform, or AI agent and keeping the API key in an environment variable. They advise against calling it directly from browser or mobile code, where users could inspect the key. This protects your CaptureKit credential; it does not document target-site login. CaptureKit overview · CaptureKit quick start

2. What the reviewed CaptureKit docs establish

Question	What the reviewed docs say
How does my application authenticate to CaptureKit?	With a CaptureKit API key sent as `x-api-key`.
What target does a capture request identify?	A target URL, with rendering and output controls documented by the endpoint reference.
Can I submit a target-site password or reuse a login session?	The reviewed endpoint reference does not document a target-site password, cookie, custom header, login flow, or browser-session parameter.
Do viewport, wait, or proxy settings log in to the target?	No such behavior is established by the reviewed docs. These are documented as rendering, timing, or routing controls.

The distinction matters: do not treat the CaptureKit API key as a target-site credential, and do not assume a browser-like rendering option creates an authenticated session.

3. Capture a public page with the documented workflow

For a page that is publicly accessible, the documented pattern is to send the target URL and your API key to CaptureKit’s screenshot endpoint. The following examples illustrate the documented API-key header pattern. Check the current endpoint reference for its exact required URL, response format, and available rendering parameters before using them in your application. They do not authenticate to a password-protected target site. CaptureKit endpoint parameters

cURL

export CAPTUREKIT_API_KEY="your_api_key"
curl --fail --silent --show-error \
  -H "x-api-key: $CAPTUREKIT_API_KEY" \
  "https://api.capturekit.dev/capture?url=https%3A%2F%2Fexample.com" \
  --output page.png

Use the endpoint URL and parameter spelling from the current CaptureKit reference for your account. This example is for an ordinary public target, not a login workflow.

Python

import os
import requests

api_key = os.environ["CAPTUREKIT_API_KEY"]
endpoint = "https://api.capturekit.dev/capture"
params = {"url": "https://example.com"}

response = requests.get(
    endpoint,
    headers={"x-api-key": api_key},
    params=params,
    timeout=90,
)
response.raise_for_status()

with open("page.png", "wb") as image_file:
    image_file.write(response.content)

Install the dependency with python -m pip install requests. Keep the key in a server-side environment variable; do not hard-code it into a client application.

Node.js

const apiKey = process.env.CAPTUREKIT_API_KEY;
if (!apiKey) throw new Error("Set CAPTUREKIT_API_KEY first");

const endpoint = new URL("https://api.capturekit.dev/capture");
endpoint.searchParams.set("url", "https://example.com");

const response = await fetch(endpoint, {
  headers: { "x-api-key": apiKey },
  signal: AbortSignal.timeout(90_000),
});

if (!response.ok) {
  throw new Error(`CaptureKit returned HTTP ${response.status}: ${await response.text()}`);
}

const image = Buffer.from(await response.arrayBuffer());
await import("node:fs/promises").then(fs => fs.writeFile("page.png", image));

Run with a Node.js version that supports the built-in fetch and AbortSignal.timeout. As with the other examples, use the current endpoint reference to confirm the endpoint path and output settings.

4. Ask support the right target-authentication questions

Before attempting a protected-page capture, ask CaptureKit support for a current, documented method that is permitted by both CaptureKit and the target site. Be specific:

Does CaptureKit support target-site authentication for screenshots?
If so, which supported mechanism applies: a session cookie, custom request header, managed login flow, or another method?
Can a session be reused across captures, and how is it isolated between customers or jobs?
How should credentials be supplied, stored, rotated, and excluded from logs?
What are the supported behavior and limits for redirects, multi-step sign-in, MFA, and session expiry?
Which endpoint parameters and response indicators confirm that the capture reached the intended protected content?

Wait for current instructions before sending passwords, cookies, or authorization material. Do not put credentials in a URL, source code, or logs. Confirm that you are authorized to access and capture the page, and follow the target site’s rules.

5. Use documented rendering options only for rendering

For a public page, CaptureKit’s endpoint reference lists controls that can affect what gets rendered and returned. The reviewed documentation describes options in these areas:

Output: PNG, JPEG/JPG, WebP, or PDF.
Page extent and target: full-page capture and element selection.
Viewport and device: dimensions, device emulation, and scale factor.
Timing: waits and delay.
Network behavior: resource or URL blocking and proxy routing.
Delivery: optional S3 storage.

These controls are useful after the target is accessible. None should be presented as a way to sign in unless CaptureKit’s current official documentation explicitly says that it performs target authentication. For names, accepted values, defaults, and output details, consult the endpoint reference.

6. Troubleshooting public-page captures

Symptom	Likely cause	What to check
CaptureKit returns an authentication error	The caller’s CaptureKit API key is missing, invalid, or sent in the wrong header.	Check that `x-api-key` is present, read the key from the intended server-side environment, and compare the request with CaptureKit’s current authentication instructions. Do not substitute the target site’s password.
The screenshot shows a login page	The target site requires a session that the documented public-URL request does not establish.	Verify the URL in a normal browser. Ask CaptureKit support whether it documents a supported target-session feature; do not infer one from the CaptureKit API key.
The result is an access-denied page or redirect	The target site may restrict access, or the requested URL may redirect to a sign-in page.	Inspect the target URL and redirect behavior. Confirm the allowed access method with the site owner and CaptureKit support.
The response is an error instead of an image	The endpoint, query parameters, API key, or requested output may not match the current API contract.	Check the response status and body, then verify the endpoint and parameter names against the official reference.
The image is incomplete or some content is missing	The page may render content after the initial load, or resources may be delayed or blocked.	For public pages, review the documented wait, delay, viewport, and resource controls. These can change rendering; they do not provide target authentication.
The request times out	The target or its resources may be slow, or the client timeout may be shorter than the capture operation.	Check CaptureKit’s documented wait and timeout behavior, use a suitable client timeout, and retry only when appropriate. Do not repeatedly send credentials while debugging.

7. Performance, reliability, and cost considerations

Rendering options can affect capture time and output size. Full-page captures may include more content than a viewport capture; waits can extend the request; image format and scale affect the result. Choose only the dimensions and output details your use case needs, and use the current endpoint reference for the supported settings. The research reviewed does not establish CaptureKit pricing, latency, reliability guarantees, or a specific target-authentication capability, so this article makes no claims about those points.

For private pages, reliability starts with a documented, authorized session method. Without one, a successful HTTP response may still contain a sign-in page rather than the requested content. For any confirmed workflow, check how the service signals capture errors and how your application can distinguish an authenticated page from a login redirect before treating an image as valid.

8. Or skip the browser setup

If your target page is publicly accessible, ScreenshotNeo offers a one-request screenshot API. This does not bypass a password wall or log in to a private target; protected-page authentication must be explicitly supported by the service and authorized by the site. ScreenshotNeo’s documented features include cookie-banner acceptance and removal of more than 60 known consent platforms, newsletter popups, and chat widgets before capture. Each step can be turned off. Bot checks or CAPTCHAs, blank pages, timeouts, failed loads, and cache hits are not billed; response headers identify the page verdict and billing status. An MCP server provides take_screenshot, get_page_info, and capture_pdf tools for AI agents. The free plan includes 1,000 shots per month with no card; paid plans start at $5 for 3,000. Learn about ScreenshotNeo. See the ScreenshotNeo API documentation.

curl -G "https://api.screenshotneo.com/v1/shot" \
  -d access_key=YOUR_API_KEY \
  --data-urlencode url=https://stripe.com \
  -o shot.webp

For a Python client:

import requests

r = requests.get(
    "https://api.screenshotneo.com/v1/shot",
    params={"access_key": "YOUR_API_KEY", "url": "https://stripe.com"},
    timeout=90,
)
open("shot.webp", "wb").write(r.content)

For Node.js:

const q = new URLSearchParams({ access_key: 'YOUR_API_KEY', url: 'https://stripe.com' });
const res = await fetch(`https://api.screenshotneo.com/v1/shot?${q}`);

9. Frequently asked questions

Does a CaptureKit API key unlock a private website?

No. It authenticates your application to CaptureKit. The reviewed docs do not establish how to authenticate CaptureKit to a protected target.

The reviewed endpoint reference describes proxy routing, not target-site sign-in. Ask CaptureKit support for an explicitly supported authentication workflow.

If the login page is publicly reachable, the documented public-page workflow may capture that page. That does not mean it can proceed through the login and capture the private content behind it.

Can ScreenshotNeo capture a page that requires a password?

The ScreenshotNeo facts provided for this article do not establish a target-site login feature. Do not assume the API bypasses a password wall; use only a supported, authorized authentication method.

Sources

CaptureKit: Capture (Screenshot) — endpoint parameters and output behavior.
CaptureKit: What is CaptureKit? — API call model and key-handling guidance.
CaptureKit: Quick start — API key setup and server-side handling.
CaptureKit: Introduction — API authentication and errors.