Recommended Free Tools
To get a screenshot API key, create an account with a screenshot provider, open its dashboard or access page, and generate or copy the credential. Treat that key like a password: keep it on your server in an environment variable or secrets manager, call the API only over HTTPS, and proxy browser requests through your backend. If a public image URL must contain authorization, use a signed link rather than exposing the secret itself.
Get the key from your provider dashboard
Provisioning is normally a dashboard action, not a code-generation task. The exact label varies—API keys, Access keys, Credentials or Tokens—but the workflow is similar.
- Choose a provider and create an account. Sign up, verify your email if required, and sign in.
- Open the access or API-key page. In ScreenshotOne, the credential is called
access_key; create or copy it from the access page. - Check the organization or project. ScreenshotOne scopes the key to an organization. Confirm that you are viewing the intended organization before copying it, especially if your account belongs to more than one.
- Copy it once into a secure secret store. If the dashboard displays the full value only once, save it directly in your deployment secret manager rather than a notes app or source file.
Other services use different names and authentication locations. Urlbox uses project secret keys with bearer authentication; Browserless uses a dashboard token with its /screenshot endpoint; ApiFlash provides a dashboard access key for GET or POST requests. Check the selected provider’s current authentication documentation before writing integration code.
Know where a provider accepts credentials
An API may accept a key in a query string, request body or header. Use the provider’s documented form, and prefer a header or server-side request body when both are available because URLs are commonly copied into logs, browser history and monitoring systems.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
| Credential location | Example | Security consideration |
|---|---|---|
| Query string | ?access_key=YOUR_KEY |
Easy to test, but URLs can be retained in logs, history and referrer data. |
| POST JSON | {"access_key":"YOUR_KEY","url":"https://example.com"} |
Keeps the value out of the URL; still send the request only over HTTPS. |
| HTTP header | X-Access-Key: YOUR_KEY |
Usually preferable for server-to-server calls when the provider supports it. |
| Bearer token | Authorization: Bearer YOUR_KEY |
Common with project-secret systems such as Urlbox; follow that service’s exact format. |
ScreenshotOne documents query-string, POST-JSON and X-Access-Key forms. Its minimal GET request is:
GET https://api.screenshotone.com/take?url=https://example.com&access_key=<your access key>
Store the key safely
Use an environment variable or secrets manager
Give the deployment a secret such as SCREENSHOT_API_KEY. Read it at runtime rather than placing the literal value in source code.
- Local development: use an ignored
.envfile or your operating system’s environment, and commit only a redacted example such asSCREENSHOT_API_KEY=replace-me. - Hosted deployment: use the platform’s encrypted environment-secret feature or a dedicated secrets manager.
- Separate environments: use different keys for development, staging and production so a test project cannot spend production quota.
- Logs and telemetry: redact query strings, authorization headers and request bodies before sending them to log storage.
ScreenshotOne’s guidance is direct: “Treat your API key like a password.” Anyone who can use the key may consume quota or access capabilities attached to its organization.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Always use HTTPS
Use an https:// endpoint for every request. ScreenshotOne warns that HTTP does not encrypt requests and can expose API keys, authorization headers, cookies and other sensitive data while they are in transit. Do not disable certificate verification to “fix” a TLS error; repair the certificate chain or runtime configuration instead.
Keep it out of frontend JavaScript
A key embedded in shipped JavaScript is public. Users can inspect a bundle, browser developer tools or a network request and copy it. CORS does not change that exposure. ScreenshotOne’s endpoint documentation recommends proxying production calls through your own server even when browser requests are technically allowed.
The safe pattern is:
- Your page sends only the target URL and capture options to your application.
- Your server validates those inputs and reads
SCREENSHOT_API_KEYfrom its environment. - Your server calls the screenshot provider over HTTPS.
- Your server streams the image or PDF back without returning the provider credential.
Validate target URLs and consider an allowlist. Without controls, a screenshot endpoint can become a proxy to internal addresses or consume your quota on arbitrary sites.
Use signed links when an image must be public
Sometimes a public page needs an image URL that triggers a screenshot service directly. Do not put the secret signing key or a reusable API key in that URL. Generate a signature on your server from the request parameters and a secret signing key, then publish only the signed result.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
ScreenshotOne says signing prevents people who see a public URL from reusing the API key. It also notes that you generally do not need signed requests when links will not be public and the API is used only server-side. Set an expiry or otherwise limit the lifetime of public links when the provider supports it.
Rotate a key after exposure
Assume a copied key is compromised. A rotation runbook should be deliberate and quick:
- Create a replacement key in the correct organization or project.
- Update the production secret and redeploy or restart services so they read the replacement.
- Revoke, delete or disable the old key in the provider dashboard.
- Search repositories, build artifacts, tickets, chat, shell history and log archives for the old value, then remove exposed copies where possible.
- Review provider usage and your own access logs for unexpected requests. If the key was embedded in a public URL, invalidate or replace those links.
Do not merely rename the environment variable while leaving the original credential active. Revocation is what stops further use.
Implement a server-side request
cURL
For a ScreenshotOne-style GET integration, keep the key in the shell environment:
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsexport SCREENSHOT_API_KEY='your-key'
curl -G "https://api.screenshotone.com/take" --data-urlencode "url=https://example.com" --data-urlencode "access_key=$SCREENSHOT_API_KEY" -o shot.png
Using --data-urlencode prevents characters in the target URL from breaking the query. Avoid pasting the expanded command into a shared terminal transcript.
Python
This example keeps the credential server-side and writes the binary response:
import os
import requests
key = os.environ["SCREENSHOT_API_KEY"]
response = requests.get(
"https://api.screenshotone.com/take",
params={"access_key": key, "url": "https://example.com"},
timeout=90,
)
response.raise_for_status()
with open("shot.png", "wb") as image:
image.write(response.content)
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Node.js
On a server running a modern Node.js release with built-in fetch:
const key = process.env.SCREENSHOT_API_KEY;
if (!key) throw new Error('SCREENSHOT_API_KEY is not set');
const query = new URLSearchParams({
access_key: key,
url: 'https://example.com'
});
const response = await fetch(`https://api.screenshotone.com/take?${query}`);
if (!response.ok) throw new Error(`Screenshot failed: ${response.status}`);
const data = Buffer.from(await response.arrayBuffer());
await import('node:fs/promises').then(fs => fs.writeFile('shot.png', data));
Or skip the browser setup
ScreenshotNeo provides a website screenshot API and MCP server. It accepts cookie and consent banners like a visitor, then removes more than 60 known consent platforms, newsletter popups and chat widgets; each cleanup step can be disabled. Only clean shots are billed: bot checks or CAPTCHAs, blank pages, timeouts, failed loads and cache hits cost nothing, and the response identifies the result with X-Page-Verdict and X-Billed headers. Its MCP tools—take_screenshot, get_page_info and capture_pdf—work with Claude, Cursor and other MCP clients.
See the complete option list and authentication details in the ScreenshotNeo documentation. A one-call request is:
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webp
Python:
import requests
r = requests.get("https://api.screenshotneo.com/v1/shot", params={"access_key": "YOUR_API_KEY", "url": "https://stripe.com"}, timeout=90)
open("shot.webp", "wb").write(r.content)
Node.js:
const q = new URLSearchParams({ access_key: 'YOUR_API_KEY', url: 'https://stripe.com' });
const res = await fetch(`https://api.screenshotneo.com/v1/shot?${q}`);
ScreenshotNeo includes full-page capture with lazy images, CSS-selector element capture, dark mode, 12 device presets plus custom viewports, retina scale, PDF paper and page controls, custom CSS and JavaScript, clicks, selector or network-idle waits, ad and tracker blocking, custom headers, cookies, user agents, authorization, timezone and geolocation, transparent backgrounds, resizing, configurable caching, signed links, asynchronous webhooks, bulk capture of up to 100 URLs per call, a usage API and an OpenAPI specification. Parameter names used by other screenshot APIs also work, which can simplify migration.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →The Free plan includes 1,000 screenshots per month with no card. Paid plans start at $5 for 3,000 shots; every feature is available on every plan. Create a free ScreenshotNeo account and keep the access key server-side.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Troubleshoot authentication and security failures
401 or 403 response
Check that the key is copied exactly, belongs to the active organization or project, and is being sent in the provider’s required parameter or header. Confirm that your deployment actually received the updated environment variable; a restart may be required. A revoked key cannot be repaired—replace it.
The request works locally but fails in production
Verify the production secret name, deployment environment and outbound-network policy. Print only whether the variable is present, never its value. Confirm that the production URL uses HTTPS and that the runtime trusts current certificate authorities.
The key appears in logs
Remove query-string and header values from application, reverse-proxy and observability logs. Rotate the credential, then check retained logs and build output for additional copies.
A public screenshot URL is being reused
Stop publishing an unsigned URL. Generate signed links on your backend, use expiry or equivalent restrictions, and rotate the signing secret if it was exposed.
Unexpected quota use
Revoke the current key and issue a replacement, then inspect usage by organization, project and endpoint. Add authentication and rate limits to your own proxy, validate destinations, and cache legitimate repeat captures.
Choosing among screenshot APIs
Compare dashboard provisioning, accepted credential locations, server-versus-browser guidance, signed-link support, endpoint method and current plan limits. Prices, quotas, retention and rate limits change, so verify them on each provider’s current plan page rather than relying on an old comparison. For a first choice, ScreenshotNeo is #1 because it produces clean shots, bills only clean captures and has the lowest paid plan.
Frequently Asked Questions
Can I use a screenshot API key in a single-page app?
Not safely if the key is long-lived: users can inspect shipped JavaScript and network requests. Send capture parameters to your backend and keep the provider credential there.
Should I put the key in a URL or header?
Use the provider’s documented method. When several are supported, a header or server-side POST generally avoids the extra exposure created by URLs in history and logs.
Do I need signed requests for every screenshot?
No. Signing is primarily for links that will be public. A private, server-side integration can normally use the API key without publishing a signature.
What is the first action after a suspected leak?
Create a replacement, update deployments, revoke the old credential, search for copies and review usage for unauthorized requests.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
