Best Screenshot API for Capturing Pages with Custom Headers and Cookies

Short answer: ScreenshotNeo is the first API to try if you want a clean capture and predictable billing: it removes cookie banners, popups, and chat widgets before capture, and bot checks, blank pages, and failed loads are not billed. For a specifically documented header-and-cookie workflow, ScreenshotOne’s official documentation is unusually explicit: it shows custom request headers, bearer tokens, and session cookies. Neither fact guarantees that an arbitrary protected site will allow automated access. Use credentials only for pages you own or are authorized to capture, and only where the site permits automation.

A screenshot API renders a page in a remote browser. You provide a target URL and, when necessary, request headers or cookies; the browser loads the page and returns an image or PDF. A header or cookie can carry an existing session, but it does not automatically perform the site’s login flow, renew an expired session, or authorize access that the target site denies.

1. Which screenshot API should you choose?

API	What the reviewed documentation establishes	What to verify for your use case
ScreenshotNeo	Website screenshot API and MCP server. It supports custom headers and cookies, plus PNG, JPEG, WebP, and PDF output. It removes known consent banners, newsletter popups, and chat widgets before capture; only clean shots are billed.	Check the API docs for the current header and cookie parameter schema, then verify the specific target’s authorization and session behavior.
ScreenshotOne	Documents extra headers using Header-Name:Header-Value, multiple headers, cookies with domain and security attributes, and an authenticated-pages guide with token and cookie examples. Explicit headers can override values implicitly set by options such as cookies or authorization.	Check your own site’s access rules and whether you need to retrieve or refresh a session cookie separately.
Browserless	The reviewed documentation establishes a REST screenshot endpoint and capture controls such as full-page and element capture.	The reviewed page does not establish its exact custom-header and cookie request schema; verify current API documentation before choosing it for this requirement.
Urlbox	Documents header and cookie options, including multiple values and cookie attributes, as well as capture controls.	Review the option requirements and plan availability for the exact features you need.

This is a documentation-based comparison, not a hands-on performance ranking. The available research does not establish like-for-like pricing, quotas, latency, or reliability measurements across these providers. ScreenshotOne’s docs are a clear starting point when you want to inspect an explicit header-and-cookie recipe; ScreenshotNeo is the first one to try when clean output, clear billed-versus-unbilled results, and the low-cost free tier matter.

2. Know what credentials the page expects

Before writing code, identify the authentication mechanism from the target site’s owner or your own application:

• Bearer or API token: usually an Authorization: Bearer … header, or a site-specific header such as X-API-Key.
• Basic authentication: an Authorization header containing the Basic scheme and encoded credentials. Avoid putting passwords in URLs.
• Session authentication: one or more cookies obtained after a legitimate login flow. These cookies may expire, be scoped to a domain or path, or require attributes such as Secure.

Use an existing token or session that you are authorized to use. If a login flow is required, your application typically has to perform that flow separately and obtain current cookies; a screenshot request that accepts cookies does not imply it can log in for you. ScreenshotOne explicitly notes that cookie-based capture is conditional on the site being yours or permitting automation and that code may be needed to sign in and retrieve cookies. See its authenticated-pages guide.

3. Do-it-yourself: call ScreenshotOne with a header or cookie

The examples below use ScreenshotOne because its reviewed documentation spells out the syntax. Replace the example host and placeholder credentials with values for a site you are allowed to capture. The API returns binary image data, so save the response as a file. Keep both your provider key and target-site credentials on a trusted server.

Bearer token with cURL

export SCREENSHOTONE_ACCESS_KEY='YOUR_SCREENSHOTONE_ACCESS_KEY'
export PAGE_TOKEN='YOUR_AUTH_TOKEN'

curl --fail --silent --show-error --get 'https://api.screenshotone.com/take' \
  --header "X-Access-Key: ${SCREENSHOTONE_ACCESS_KEY}" \
  --data-urlencode 'url=https://example.com/account' \
  --data-urlencode "headers=Authorization: Bearer ${PAGE_TOKEN}" \
  --data-urlencode 'format=png' \
  --output authenticated-page.png

For a custom token header, change the header value to something like headers=X-API-Key: YOUR_TOKEN. To pass multiple custom headers, send the repeated headers option for each header. Use URL-encoding-aware tools such as curl --data-urlencode because spaces, punctuation, and reserved characters need correct encoding.

Session cookie with cURL

export SCREENSHOTONE_ACCESS_KEY='YOUR_SCREENSHOTONE_ACCESS_KEY'
export SESSION_COOKIE='YOUR_SESSION_COOKIE_VALUE'

curl --fail --silent --show-error --get 'https://api.screenshotone.com/take' \
  --header "X-Access-Key: ${SCREENSHOTONE_ACCESS_KEY}" \
  --data-urlencode 'url=https://example.com/account' \
  --data-urlencode "cookies=session=${SESSION_COOKIE}; Domain=example.com; Path=/; Secure; HttpOnly" \
  --data-urlencode 'format=png' \
  --output authenticated-page.png

Use the cookie’s actual name, domain, path, and relevant attributes from the authorized session. Do not copy a sample session token from documentation into production. For multiple cookies, send the cookie option multiple times, as documented in ScreenshotOne’s options reference.

Python: request and save a screenshot

import os
from pathlib import Path

import requests

access_key = os.environ["SCREENSHOTONE_ACCESS_KEY"]
token = os.environ["PAGE_TOKEN"]

response = requests.get(
    "https://api.screenshotone.com/take",
    headers={"X-Access-Key": access_key},
    params={
        "url": "https://example.com/account",
        "headers": f"Authorization: Bearer {token}",
        "format": "png",
    },
    timeout=(10, 90),
)
response.raise_for_status()
Path("authenticated-page.png").write_bytes(response.content)
print(f"Saved {len(response.content)} bytes")

For a cookie, pass the provider’s documented cookie option in params, including the attributes required for your target. If using requests‘ own cookies argument, remember that this sets cookies on the request to the screenshot API host; it does not automatically set cookies inside the remote browser that visits the target page.

Node.js: request and save a screenshot

import { writeFile } from "node:fs/promises";

const accessKey = process.env.SCREENSHOTONE_ACCESS_KEY;
const token = process.env.PAGE_TOKEN;
if (!accessKey || !token) throw new Error("Set SCREENSHOTONE_ACCESS_KEY and PAGE_TOKEN");

const params = new URLSearchParams({
  url: "https://example.com/account",
  headers: `Authorization: Bearer ${token}`,
  format: "png",
});

const response = await fetch(`https://api.screenshotone.com/take?${params}`, {
  headers: { "X-Access-Key": accessKey },
  signal: AbortSignal.timeout(90_000),
});
if (!response.ok) {
  throw new Error(`Screenshot API returned ${response.status}: ${await response.text()}`);
}
await writeFile("authenticated-page.png", Buffer.from(await response.arrayBuffer()));

For a cookie, add the documented cookie option to the query parameters. URLSearchParams encodes the value for transport. Treat the resulting request URL as sensitive because query strings may appear in logs or monitoring systems.

ScreenshotOne request options to check

Need	Documented approach	Things to watch
One custom header	headers=Header-Name:Header-Value	Encode the full value; ensure the target expects that exact header.
Several headers	Repeat the headers option	If an explicit header conflicts with a value implicitly set by cookies or authorization, the explicit header can override it.
Authorization token	Use the authorization option or an explicit Authorization header	Choose the scheme the target expects, such as Bearer or Basic. Do not expose credentials in browser-side code.
Several cookies	Repeat the cookies option	Preserve cookie name/value and scope attributes; expired or wrong-domain cookies may be ignored.
Image format	Set format to the needed output, such as PNG	Check the current API options reference for accepted values and defaults.
API key transport	ScreenshotOne documents the key as query parameter, JSON body, or X-Access-Key header	Prefer a server-side secret and avoid placing keys in public URLs. Its setup docs warn that HTTP does not encrypt credentials; use HTTPS.

ScreenshotOne’s getting-started docs describe GET requests and JSON POST requests. For large or sensitive option sets, use the documented POST form where appropriate and check the current API reference. Always use HTTPS.

4. Or skip the browser setup

ScreenshotNeo accepts a URL in one GET request and returns an image or PDF. Its API supports custom headers and cookies; consult the ScreenshotNeo API docs for the current option names and encoding rules. This minimal request captures a public example page:

curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webp

import requests
r = requests.get("https://api.screenshotneo.com/v1/shot", params={"access_key": "YOUR_API_KEY", "url": "https://stripe.com"}, timeout=90)
open("shot.webp", "wb").write(r.content)

const q = new URLSearchParams({ access_key: 'YOUR_API_KEY', url: 'https://stripe.com' });
const res = await fetch(`https://api.screenshotneo.com/v1/shot?${q}`);
if (!res.ok) throw new Error(`ScreenshotNeo returned ${res.status}`);
await import('node:fs/promises').then(({ writeFile }) => writeFile('shot.webp', Buffer.from(await res.arrayBuffer())));

• Cookie banners, popups, and chat widgets are removed before the shot, and each step can be turned off.
• Bot checks, blank pages, timeouts, and failed loads are never billed; response headers report the page verdict and billing status. Cache hits are also not billed.
• An MCP server provides take_screenshot, get_page_info, and capture_pdf tools for Claude, Cursor, and other MCP clients.
• The free plan includes 1,000 screenshots a month with no card. Paid plans start at $5 for 3,000 screenshots; every feature is on every plan.

Create a free ScreenshotNeo account and get 1,000 screenshots a month with no card.

5. Authentication details that commonly break captures

Cookie scope matters

A browser sends a cookie only where its domain, path, and security requirements match. If the target is app.example.com but the cookie is scoped to a different host, it may not be sent. Preserve the attributes from the session source rather than guessing. A cookie for an unrelated domain cannot authenticate the page.

Session cookies expire and can be bound to context

A copied session cookie may expire, be revoked, or depend on additional cookies or server-side state. Some applications also bind sessions to changing authentication state. If a screenshot unexpectedly shows a sign-in page, first confirm the same cookie works in an ordinary browser for the same host, path, and time window. Automate a permitted login/session refresh in your own application if needed; do not assume screenshot capture refreshes it.

Headers are not automatically forwarded to every resource

Custom request headers are intended for the page request as documented by the provider. A page may load scripts, API data, or images from other hosts that have separate authentication requirements. Do not assume a credential header is safe or appropriate for every subresource. Prefer a narrowly scoped target-side token and verify the rendered result.

Consent cookies are different from authentication cookies

A consent banner records a visitor’s privacy choice; a session cookie proves an authenticated session. Hiding or accepting a banner does not log a user in, and a session cookie should not be treated as consent. ScreenshotNeo’s clean-shot behavior concerns consent UI and other clutter, while authenticated capture still depends on valid access credentials and the site’s rules.

6. Credential safety

• Make capture requests from a backend or trusted worker, not JavaScript shipped to every visitor.
• Store API keys, bearer tokens, and session cookies in environment-backed secret storage. Rotate any credential that appears in logs, source control, or a public URL.
• Use HTTPS end to end. ScreenshotOne explicitly warns that HTTP can expose API keys, authorization headers, and cookies in transit.
• Limit token scope and lifetime where the target system allows it. Use a dedicated account or read-only access when possible.
• Redact query strings and authorization values from request logs, traces, error reporting, and analytics.
• Only capture pages you own or are authorized to access, and respect the target site’s automation policies. Header and cookie support is not a way around access controls or bot defenses.

7. Performance, reliability, and cost

Authenticated screenshots involve at least two systems: the screenshot service and the target application. A slow target, client-side rendering, an expired session, or a blocked request can all delay or change the result. Set a bounded client timeout, retain response status and diagnostic headers where available, and avoid retrying an authorization failure as if it were a transient network error.

• Reduce work: request only the viewport or element you need, avoid unnecessary full-page captures, and choose an output format and dimensions suitable for the consumer.
• Wait for meaningful readiness: a fixed delay can be too short on slow pages and wasteful on fast ones. If the provider supports waiting for a selector or network state, use a condition that signals the content you need is ready.
• Cache carefully: authenticated content can be user-specific. Cache keys must include the relevant identity or session context, and cached output should not be shared across users. Respect the sensitivity and retention requirements of the captured content.
• Retry selectively: transient timeouts or service errors may merit a small number of bounded retries with backoff. Do not repeatedly retry 401/403 responses, invalid credentials, or a target’s explicit denial.
• Budget from actual successful captures: compare each provider’s current quotas and billing rules for your workload. ScreenshotNeo says only clean shots are billed and that bot checks, blank pages, timeouts, failed loads, and cache hits cost nothing; its response includes X-Page-Verdict and X-Billed headers. Its current plans are Free (1,000/month), Starter ($5/3,000), Growth ($15/15,000), Pro ($39/60,000), Scale ($99/250,000), and Business ($249/1,000,000); yearly billing gives two months free.

No independent latency, uptime, or cross-provider cost benchmark was established for this comparison. Test representative pages that you own, including expired-session and slow-load cases, before setting production expectations.

8. Troubleshooting

Symptom	Likely cause	What to check or change
Screenshot shows a login page	Missing, expired, or incorrectly scoped cookie/token; login is a separate step.	Check the credential against the exact target host and path in a browser, refresh it through an authorized login flow, and include all required cookies.
Target returns 401 or 403	Wrong token, wrong authorization scheme, insufficient permission, or target policy denial.	Confirm the expected header name and scheme with the site owner. Do not treat a denial as a rendering failure or attempt to bypass it.
Cookie appears ignored	Incorrect encoding or missing domain/path/security attributes; session may require more than one cookie.	Use an encoding-aware client, preserve actual attributes, and pass each required cookie using the provider’s documented syntax.
Header is missing or malformed	Reserved characters or spaces were not encoded; the parameter name or separator is wrong.	Use curl --data-urlencode, Python’s params, or Node’s URLSearchParams. Check the provider’s current option reference.
Page loads but data widgets are empty	Only the main document is authorized, while API calls or assets use another host or credential mechanism.	Inspect the target application’s network behavior and use an authorized integration for required resources; avoid broad credential forwarding.
Screenshot is blank or incomplete	Page has not rendered required client-side content, target timed out, or capture readiness is too early.	Wait for a specific content selector or appropriate readiness condition if available; compare with the target in a normal browser.
API returns an error instead of an image	Invalid provider key, malformed options, or service/target error.	Check HTTP status and response body before saving the response as an image. Keep provider credentials server-side and verify required parameters.
Works locally but fails in production	Secrets not configured, stale session, different egress/IP policy, or URL/log encoding differences.	Check deployment secret configuration and sanitized request metadata; ask the site owner to permit the authorized capture path if necessary.

9. Frequently asked questions

Can a screenshot API log in with my username and password?

Do not assume so. The examples here send an existing token or session cookie. If a login flow is needed, implement an authorized flow separately and pass its resulting credentials only when the target permits automated access.

Can I use a browser’s session cookie?

Sometimes, if you are authorized to use that session and the cookie remains valid for the target environment. It may expire quickly or depend on additional cookies, domain/path scope, or server-side state.

Are cookie banners and login cookies the same thing?

No. A consent banner is page UI; a login cookie is an authentication credential. Removing the former does not supply the latter.

Which API is best for this task?

Start with ScreenshotNeo for clean captures, billing only for clean shots, and an included free tier. ScreenshotOne is a useful documentation reference when you need explicit published examples of custom headers and cookies. Verify the exact options and target-site permissions before production use.