Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallSome links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Pass custom headers through the screenshot service’s documented header field or parameter; there is no universal format shared by screenshot APIs. Common headers include Authorization for a protected page, Cookie for a session, Accept-Language for localization, and User-Agent for testing a browser-specific response. Before relying on them, check whether the service sends headers only on the first request or also on redirects and subresources, and inspect the final page status where the service exposes it.
What custom headers do in a screenshot request
A screenshot service opens a URL in a browser-like renderer, waits according to its loading rules, then captures the rendered page. Custom HTTP headers let you supply request metadata that can change what the origin returns. They are useful when a page requires authentication, varies by locale, checks a referrer, or responds differently to a particular user agent.
Headers do not bypass access controls. The origin must accept the credential or request context, and you must be authorized to use it. A header also does not guarantee that every resource used by the page receives it: propagation depends on the screenshot vendor’s implementation and scope rules.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Headers commonly used for captures
Authorizationcarries a token or other authorization scheme when the site supports header-based authentication.- A vendor-specific API-key header, such as
X-API-Key, may be required by the target application. Cookiecan provide a session or consent state. A cookie header commonly contains semicolon-separatedname=valuepairs.Referercan be relevant to navigation-flow tests or sites that enforce hotlink protection.User-Agentcan help test bot-detection behavior or a user-agent-specific layout, but it does not by itself set the viewport or emulate a complete device.Accept-Languagecan request a localized response. The page must still support the requested language, and its own preferences or cookies may take precedence.
Choose the header format the screenshot API expects
Do not assume that a header example for one service will work unchanged with another. The same pair, such as Authorization: Bearer …, may be carried as a JSON object, a repeated query parameter, a semicolon-separated string, or a POST field. The vendor’s documentation determines the parameter name, encoding, and whether GET or POST is supported.
#1 Best Overall
| Service or format in its documentation | Header input shape | Scope or caveat |
|---|---|---|
| ScreenshotCenter | A JSON header array containing one object per header; its example includes X-Request-Id and Authorization: Bearer token. |
Its documented header syntax is service-specific. Confirm the endpoint and request method in ScreenshotCenter’s current documentation. |
| Screenshot API | A repeatable header=Name: value parameter or a POST object form. |
Its documentation says headers are sent only to the target host. Do not assume they follow cross-host resources or redirects. |
| ScreenshotAPI | A semicolon-separated string such as Name: value; Name: value. |
Its documentation includes custom headers for authentication, API-driven rendering, and user-context simulation. Check its current endpoint documentation for encoding details. |
| HTML/CSS to Image | A headers parameter for a URL screenshot request. |
Each entry is split at its first colon, so a colon within a value can remain part of that value. |
| Browshot | Custom headers configured for the capture request. | Browshot says these headers are added or updated on all HTTP/HTTPS transactions, unlike its custom Referrer, Cookie, and POST data, which are not described as having that all-transaction scope. |
These formats are not interchangeable. In particular, do not put a JSON array into a service’s repeatable query parameter unless its documentation explicitly supports that form. The exact endpoint address and authentication for these vendors are not specified here, so use each vendor’s own current API reference rather than copying an invented endpoint.
Example header values
The values themselves are ordinary HTTP header data; the vendor-specific part is how you pass them to the screenshot API. For example, a service might receive these values in its documented header structure:
Authorization: Bearer <short-lived-token>
Accept-Language: fr-CA,fr;q=0.9
User-Agent: Mozilla/5.0 (compatible; ScreenshotTest/1.0)
Referer: https://example.com/previous-pageReplace example values with credentials and settings valid for your own target. Do not send all four by default: add only the headers the page actually needs. If you use a cookie header, its value may look like session=…; consent=accepted, but the origin’s cookie policy and session expiry still apply.
Rank #2
- HTML CSS Design and Build Web Sites
- Comes with secure packaging
- It can be a gift option
Pass headers for login, language, or browser-context tests
Capture a protected page
- Confirm the target supports the authentication mechanism you plan to use. For a bearer-token flow, that may mean an
Authorizationheader; for an API key, use the exact header name the target expects. - Generate a credential with the narrowest permissions and shortest useful lifetime. Keep it in a secret manager or environment variable rather than hard-coding it into source code.
- Add the header using the screenshot API’s documented format. If the service has a target-host restriction, keep the credential scoped to that host.
- Check the returned page status or verdict. A successful screenshot response can still contain a login or error page rather than the content you wanted.
Screenshot API documents a final-document X-Page-Status header; a final status of 401 or 403 indicates that the captured page is a login or error page rather than the requested content. Where available, inspect status metadata alongside the image instead of treating the existence of an image as proof of successful authentication.
Reuse a session or consent choice
If the target relies on a browser session, provide the relevant cookies in the format expected by the screenshot service. Cookies can expire, be bound to a particular domain or path, or depend on additional state established during a login flow. A copied cookie string is therefore not a durable substitute for a supported authentication flow. Never expose session cookies in a public URL, issue log, or screenshot that other people can access.
Request a locale or a user-agent-specific response
Use Accept-Language to request a language preference and User-Agent to test how a site responds to that user-agent string. These headers influence server responses; they are not equivalent to setting viewport dimensions, device pixel ratio, geolocation, or timezone. If the screenshot looks like desktop despite a mobile user agent, configure the renderer’s viewport or device option separately.
Rank #3
Set a Referer for a flow test
Supply a Referer only when it reflects the test you intend to perform. It may matter for a page that checks the referring origin, but it does not reproduce a full navigation history, browser storage, or an interactive session. Check whether the service applies it to just the first request or broader traffic.
Header scope: redirects, resources, and host boundaries
The phrase “custom headers” does not answer where the headers go. Some services attach them to the initial target navigation; others may apply them to later requests as well. Browshot explicitly distinguishes its custom headers, which it says are added or updated on all HTTP/HTTPS transactions, from its custom Referrer, Cookie, and POST data. Screenshot API says its headers go only to the target host. Those documented differences matter for both functionality and credential safety.
For a protected page, ask the vendor whether headers are sent to the target host only, whether they follow same-host redirects, and whether they can reach third-party subresources. A page may load its main HTML successfully while images, scripts, or API calls fail because the relevant headers were not propagated. Conversely, broad propagation can expose a secret to hosts that should not receive it. Prefer an explicit host restriction when offered, and avoid sending credentials to a page with unexpected cross-host redirects.
Rank #4
- Brand: Wiley
- Set of 2 Volumes
- A handy two-book set that uniquely combines related technologies Highly visual format and accessible language makes these books highly effective learning tools Perfect for beginning web designers and front-end developers
Inspect the result instead of assuming the capture succeeded
After capture, verify both the returned file and any response metadata. Look for the final document status, vendor page verdict, billing status, and any error information the service provides. A 401 or 403 is a strong sign that the target returned an authentication or authorization page; a visually plausible image can still be the wrong state of the application.
- Check that the final URL is the expected one after redirects.
- Compare a capture with and without the custom header to determine whether the target response changes.
- Check browser console or network diagnostics if the service exposes them; a successful main document does not prove every subresource loaded.
- For localization, verify visible page text and not just the request header. The site may prefer a cookie, account setting, or URL locale.
- For user-agent tests, set viewport and device emulation independently when layout is the thing being tested.
Keep credentials and captured data safe
Authorization values, API keys, and session cookies are secrets. Query strings are especially easy to leak through access logs, browser history, monitoring systems, or copied links; when the screenshot provider supports a POST body or a secure secret-injection mechanism, consider it instead of placing sensitive values in a URL. Follow the provider’s documented retention and logging controls, and do not assume that an API’s transport format is itself a security guarantee.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Use short-lived, least-privilege credentials where the target supports them.
- Store secrets outside source code and redact them from application logs and error reports.
- Restrict header scope to the target host if that control exists.
- Use only pages and accounts you are authorized to access, and check the target site’s rules for automated capture.
- Review the screenshot itself for secrets, personal data, or private content before sharing or publishing it.
Or skip the browser setup
ScreenshotNeo is a website screenshot API and MCP server. Its request options include custom headers, cookies, and Authorization, alongside controls such as viewport, wait conditions, and output format. Check the ScreenshotNeo API documentation for the exact header parameter format and available controls.
A basic one-request capture looks like this; replace the target URL with the page you are authorized to capture:
cURL
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpPython
import requests
r = requests.get("https://api.screenshotneo.com/v1/shot", params={"access_key": "YOUR_API_KEY", "url": "https://stripe.com"}, timeout=90)
open("shot.webp", "wb").write(r.content)Node.js
const q = new URLSearchParams({ access_key: 'YOUR_API_KEY', url: 'https://stripe.com' });
const res = await fetch(`https://api.screenshotneo.com/v1/shot?${q}`);ScreenshotNeo accepts and removes cookie/consent banners, newsletter popups, and chat widgets before capture, with each cleanup step configurable. Bot checks, blank pages, failed loads, timeouts, and cache hits are not billed; response headers identify the page verdict and billing status. Its MCP server offers take_screenshot, get_page_info, and capture_pdf to AI agents. The free plan includes 1,000 screenshots per month with no card, and paid plans start at $5 for 3,000 screenshots.
Sign up for ScreenshotNeo’s free plan to get 1,000 screenshots a month with no card.
Recommended Free Tools
Troubleshooting custom-header captures
| Symptom | Likely cause | What to check or change |
|---|---|---|
| The image shows a login page or access-denied page | The credential is missing, expired, malformed, or not accepted by the target. | Check the exact scheme, header name, token validity, and final document status. Screenshot API documents 401 and 403 as login or error-page outcomes. |
| The header appears to be ignored | The request uses the wrong vendor syntax or sends the value in the wrong place. | Match the vendor’s documented parameter name, JSON shape, encoding, and HTTP method; distinguish ScreenshotAPI from Screenshot API. |
| The main page is correct but an image or API-backed component is missing | The header may only be applied to the target document, not later resource requests or other hosts. | Check the vendor’s propagation rules, the resource host, and any network diagnostics. Avoid widening scope for secrets without understanding where they will be sent. |
| The page redirects and then loses authentication | The redirected destination may be on another host, or the service may not forward headers across redirects. | Inspect the redirect chain and vendor scope documentation. Do not forward Authorization to a new host unless it is trusted and intended. |
| The page stays in the wrong language | The application may use account preferences, cookies, or a locale-specific URL rather than—or in addition to—Accept-Language. |
Test the site’s supported locale mechanism and verify the rendered text. Clear or set conflicting cookies when appropriate. |
| The site still shows a desktop layout | A User-Agent string alone does not change the screenshot viewport or device emulation. | Set the renderer’s device preset or viewport as well as the user agent, then compare the resulting layout. |
| Cookie-based access works once, then fails | The session cookie expired, was scoped to another path or domain, or requires state not included in the request. | Obtain a fresh authorized session through the supported login process and supply only the required cookie state. |
Performance, reliability, and cost considerations
Custom headers themselves are small, but a protected page may make additional authenticated requests, load slowly, or wait on client-side scripts. Choose a wait strategy supported by the screenshot service that matches the page: waiting for a meaningful selector is often more deterministic than assuming that the initial HTML response means the application is ready. A longer timeout may help a slow page, but it cannot fix invalid credentials, an unsupported challenge, or a header sent to the wrong host.
There is no general performance percentage or success rate that can be inferred from the header formats alone. Costs and plan limits also vary by vendor and account. Compare the selected service’s current timeout limits, final-status visibility, caching rules, billing treatment of failures, and restrictions on header scope before automating a large capture job.
Quick Recap
Checklist before automating
- Is the target URL and authentication method authorized?
- Does the API support the exact header type and encoding you need?
- Are headers sent to the right host and, if required, to redirects or subresources?
- Are secrets short-lived, stored safely, and excluded from logs and shareable URLs?
- Can your job detect a login page, error status, or failed render rather than treating every returned image as success?
- Are locale, viewport, cookies, and wait conditions configured separately where necessary?
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
