Can a Website Screenshot API Capture Pages Behind a Paywall?

Yes. A website screenshot API can capture a page behind a paywall when its browser can reach the page using valid credentials for an account authorized to view it. Without the right session cookie, authorization header, or HTTP Basic Auth credentials, the browser will usually show a sign-in page instead. Authentication lets the API use existing access; it does not provide a subscription or permission to bypass a publisher’s access controls.

This guide covers authorized captures: choosing the authentication method, keeping credentials safe, waiting for the article to render, and checking that the returned image contains the intended page.

How authenticated screenshot capture works

A screenshot service loads the target page in a browser and captures what that browser can see. To capture a subscriber page, the browser must have access to the same content as the signed-in account. Depending on the site’s login design and the API’s features, that can mean passing an existing session cookie, an authorization header or token, or HTTP Basic Auth credentials. These mechanisms are different and cannot be substituted for one another.

For example, Cloudflare Browser Run documents cookies, Basic Auth, and authorization headers for authenticated screenshots. Microlink documents forwarding cookies and authorization headers. Those are documented capabilities, not a hands-on comparison; check each provider’s current documentation for exact parameters, endpoints, and plan requirements.

Choose the authentication method

What the site uses	What the screenshot browser may need	What to verify
An existing signed-in session	A current session cookie	Cookie name and value, domain and path scope, expiry, and whether the API accepts cookies.
HTTP Basic Auth	Basic Auth credentials or an Authorization header	The site actually uses Basic Auth and the API supports it.
Bearer or other token-based access	The target site’s Authorization header	The header reaches the target page, the token is valid, and the API supports header forwarding.
Interactive sign-in	An authorized browser workflow, if the provider supports it	MFA, passkeys, bot checks, and changing login steps can prevent automation. Passing a cookie or header does not perform a full login.

Prefer a narrowly scoped, short-lived credential that your application already uses, when the site supports it. A screenshot API feature may be plan-specific: Microlink, for example, documents header forwarding as requiring its Pro plan and Pro endpoint. Confirm current product documentation before choosing an implementation.

Capture an authorized page step by step

1. Confirm access and permitted use. Open the exact article in a normal browser using the intended account. Confirm that capturing and storing it is authorized for your purpose.
2. Identify the site’s login mechanism. Determine whether access comes from a session cookie, Basic Auth, or a token/header. Do not assume that a password login flow can be automated by a cookie-forwarding feature.
3. Choose an API that supports that mechanism. Check its current documentation for the credential format, endpoint, required plan, and any restrictions.
4. Send credentials from a protected backend. Keep secrets out of browser-visible code, URLs, source control, and logs. Microlink recommends sending secrets in request headers rather than query strings; credentials in URLs can end up in logs or browser history.
5. Wait for the page content. For JavaScript-rendered pages, wait for a meaningful article selector or a documented page-readiness condition where available. Navigation finishing does not always mean the article has rendered.
6. Inspect the capture. Check the returned status and final URL where exposed, and inspect the image for a login form, an error page, or missing content. A successful API request alone does not establish that the intended article loaded.
7. Handle credentials and captures carefully. Refresh expired credentials when needed, and limit retention and sharing of both credentials and subscriber content to the authorized purpose.

Example request shape

There is no universal request parameter for authenticated captures: cookie and header names, request format, and endpoint vary by API. Use your provider’s documented interface, and send the credential using the channel it supports. The following is a schematic example only; replace the endpoint and parameter names with those in the provider’s documentation. It illustrates a session-cookie request, not a real API contract.

curl -X POST "https://api.example.com/screenshot" \
  -H "Authorization: Bearer YOUR_SCREENSHOT_API_KEY" \
  -H "Content-Type: application/json" \
  --data '{
    "url": "https://publisher.example/article",
    "cookies": [{
      "name": "session",
      "value": "YOUR_AUTHORIZED_SESSION_COOKIE",
      "domain": "publisher.example",
      "path": "/"
    }],
    "waitForSelector": "article"
  }' \
  --output article.png

This example intentionally uses a placeholder domain and provider. Do not send real session values to an endpoint unless you have verified how that provider handles them. If the target uses Basic Auth or a bearer token, use the provider’s corresponding documented method instead of inventing cookie fields.

Check that the result is the intended page

• Look at the image: does it show the article, a sign-in form, an access-denied page, or a challenge?
• Check the final URL and page status if the provider exposes them. A redirect to a login route is a strong sign that the session was not accepted.
• Confirm that the main article selector was present before capture, if the API supports waiting for a selector.
• For long pages, confirm full-page capture and lazy-loaded content behavior. A viewport screenshot can omit content below the fold.
• If the capture will be used as a record, consider whether a screenshot is suitable: it is a visual image and may omit text outside the captured area or content that had not loaded.

Screenshot API documents an X-Page-Status header and notes that a 401 or 403 can correspond to a login or error page in the rendered image. Check the chosen provider’s documentation for its own status and result headers.

Security, access, and reliability limits

• Credentials are sensitive. Treat cookies and tokens like passwords. Avoid putting them in query strings or client-side code. Restrict who can call the capture endpoint and who can retrieve stored results.
• Authentication does not grant rights. It gives the browser the account’s existing access. It does not create a subscription or authorize capturing, retaining, or redistributing content beyond the account’s permitted use.
• Sessions expire and are site-specific. A cookie may be expired, scoped to a different host or path, or rejected when used from the screenshot browser. Cookie details vary by site.
• Bot checks can still block capture. Cloudflare documents that changing the user agent does not bypass its bot identification. MFA and other interactive checks may also prevent a simple cookie or header workflow.
• Page rendering can be delayed or incomplete. Ads, scripts, lazy images, and client-side rendering can affect what appears. Use a content-based readiness signal where possible, then inspect the result.
• Provider plans differ. Confirm whether cookie or header forwarding, waits, and the needed output format are available on your endpoint and plan.

Troubleshooting common failures

Symptom	Likely cause	What to try
The screenshot shows a login form	No credentials were sent, the cookie expired, its scope is wrong, or the site did not accept it.	Sign in normally again, check cookie host/path and expiry, and confirm the provider supports the authentication method.
The result is an access-denied or challenge page	The site’s bot protection or interactive verification blocked the browser.	Do not rely on user-agent changes to bypass bot checks. Use an authorized workflow supported by the site and provider, or request an approved export/access method.
The API reports success but the image is wrong	The API request succeeded while the browser rendered a redirect, login page, or site error.	Inspect the image, final URL, and exposed page-status field; add a wait for the article’s main selector if available.
The image is blank or missing article content	Capture began before client-side rendering completed, or the selector did not match.	Verify the selector in the normal page, wait for a meaningful content element, and allow the site’s required rendering time.
The credential works locally but not through the API	The credential may be host-bound, IP-sensitive, expired, or unsupported by the API’s forwarding method.	Check the provider’s cookie/header format and the site’s session behavior. Do not broaden credential scope without a security reason.
401 or 403 status	The target rejected authentication or returned a protected error page.	Check the account’s access, credential validity, header/cookie delivery, and final URL. Screenshot API notes these statuses can indicate a login or error page.
Capture times out	The page or its scripts did not finish within the provider’s time limit, or the wait condition never appeared.	Use a stable selector, review the provider’s timeout limits, and avoid waiting for every network request if the page keeps long-lived connections open.

Performance, reliability, and cost considerations

An authenticated capture adds browser navigation and page-rendering work; the time to produce an image depends on the target site, scripts, authentication checks, and chosen wait condition. A selector that signals article content is usually more meaningful than an arbitrary short delay, while a timeout is still needed for pages that never reach that state.

For repeat captures, use caching only when the freshness and authorization requirements allow it. A cached image can be stale after the publisher updates the article or the account’s access changes. Avoid caching or retaining sensitive subscriber material longer than necessary. Cost depends on the provider’s pricing and plan rules, including whether failed or blocked captures are billable; verify those rules before scaling a workflow. This dossier contains no comparative benchmarks or universal price figures.

Or skip the browser setup

ScreenshotNeo is a website screenshot API and MCP server from ScreenshotNeo. It supports custom headers, cookies, and Authorization, so it can be used for an authorized capture when the site accepts a credential you are permitted to use. It does not provide a subscription or bypass access controls. See the ScreenshotNeo API documentation for request options.

curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webp

For a protected page, add the appropriate cookie or Authorization configuration as documented for the API and target site. The simple example above shows the one-call screenshot request; it does not include authentication parameters. ScreenshotNeo removes cookie banners, popups, and chat widgets before the shot, with each cleanup step configurable. Bot checks, blank pages, and failed loads are never billed. Its MCP server lets AI agents use take_screenshot, get_page_info, and capture_pdf. The free plan includes 1,000 screenshots per month with no card; paid plans start at $5 for 3,000 screenshots.

Sign up for ScreenshotNeo free: 1,000 screenshots a month, no card required.

FAQ

Can I screenshot a paywalled article without an account?

No. The screenshot browser needs valid access to the page. A screenshot API does not supply a subscription or permission to bypass the publisher’s controls.

Does passing a cookie log in to the website?

It presents an existing session to the browser. It is not the same as carrying out an interactive sign-in, and the cookie must still be valid and accepted by the site.

Why does a successful API response still show a login page?

The API may have successfully returned an image of the page the browser reached, even though authentication failed. Inspect the image and the final URL or page-status information if available.

Can I use a screenshot as a complete text archive?

Not necessarily. It captures rendered pixels and may miss content that was outside the capture, hidden, or not yet loaded. Use an authorized text, accessibility, or export method when exact text is required.