Recommended Free Tools
Call await page.authenticate({ username, password }) on the Puppeteer page before navigating to the protected URL. Puppeteer enables request interception behind the scenes to implement authentication, which may affect performance.
Authenticate a page before navigation
Page.authenticate() accepts an object with string username and password fields. The method returns a promise, so await it before calling page.goto(). The following ES module example reads the credentials from environment variables rather than embedding them in source code:
As an Amazon Associate I earn from qualifying purchases.
import puppeteer from 'puppeteer';
const browser = await puppeteer.launch();
try {
const page = await browser.newPage();
await page.authenticate({
username: process.env.HTTP_AUTH_USERNAME,
password: process.env.HTTP_AUTH_PASSWORD,
});
const response = await page.goto('https://example.com/protected');
console.log(response?.status());
} finally {
await browser.close();
}Set HTTP_AUTH_USERNAME and HTTP_AUTH_PASSWORD in the process environment before running the script, and replace the example URL with the resource you need. These variable names are a sample secret-handling convention, not a Puppeteer requirement. The API’s documented credentials shape is described in the Credentials interface; see also the Page.authenticate() reference.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Choose the right API for the request
| API or option | What it does | Use it when |
|---|---|---|
page.authenticate({ username, password }) |
Provides credentials for HTTP authentication on the Page. | The target resource requires HTTP authentication. |
page.authenticate(null) |
Disables authentication for the Page. | You need to turn off credentials previously enabled through this API. |
page.setExtraHTTPHeaders(headers) |
Sends additional headers with every request initiated by that Page. | Your task requires arbitrary extra request headers rather than the documented HTTP-auth API. |
BrowserContextOptions.proxyServer |
Configures a proxy server. The Puppeteer Next reference says proxy username and password can be set with Page.authenticate(). |
You are configuring a proxy; consult the Next documentation and verify behavior for your setup. |
Header names passed to Page.setExtraHTTPHeaders() are lowercased, and Puppeteer does not guarantee their outgoing order. The documentation does not establish that custom headers replicate every authentication scheme or server behavior. For those reasons, use Page.authenticate() for HTTP authentication rather than assuming a manually supplied header is equivalent. See the Page.setExtraHTTPHeaders() reference.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
The proxy guidance above comes from Puppeteer’s page explicitly labeled Next BrowserContextOptions. It does not establish credential scope across multiple origins, proxies, or simultaneous challenges; check the behavior required by your configuration rather than generalizing it.
Account for interception and performance
Puppeteer’s authentication method documentation says: “Request interception will be turned on behind the scenes to implement authentication. This might affect performance.” This is a qualitative warning, not a published slowdown figure. If capture speed matters, measure your own workflow with and without authentication under the same conditions; no universal numeric cost is established by the documentation.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Troubleshoot authentication results
- The protected page still rejects access: Confirm both values are strings and that
await page.authenticate(...)completes before navigation. Verify the credentials and resource with the service owner; server responses and supported schemes can differ. - The request appears to succeed but access failed: Check
response?.status(). An HTTP error such as 401, 404, or 503 is still an HTTP response and is not necessarily a transport-level request failure. Puppeteer’s request-event documentation explains that HTTP errors can still complete withrequestfinished; see the HTTPRequest reference. - You expected an arbitrary header to authenticate:
setExtraHTTPHeaders()applies headers to all requests initiated by the Page; it is not documented as a substitute for every authentication scheme. Use the authentication API when the requirement is HTTP authentication. - Navigation or capture became slower: Authentication enables request interception behind the scenes. The documentation warns of a possible performance effect but gives no measurement, so compare timings in your own scenario.
- Authentication should no longer be active: Await
page.authenticate(null)to disable it.
Or skip the browser setup
If your goal is a screenshot rather than an interactive Puppeteer session, ScreenshotNeo returns a screenshot or PDF from one GET request. Its API can remove cookie and consent banners, newsletter popups, and chat widgets before capture. Bot checks, blank pages, failed loads, timeouts, and cache hits are not billed. It also provides an MCP server for AI agents, with tools including take_screenshot, get_page_info, and capture_pdf.
Example using cURL (replace the target URL and provide your API key):
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpSee the ScreenshotNeo API documentation for request options. The free plan includes 1,000 screenshots per month with no card; paid plans start at $5 for 3,000. Sign up for 1,000 free screenshots a month, with no card required.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Frequently Asked Questions
Does Puppeteer require specific environment variable names for credentials?
No. The example uses HTTP_AUTH_USERNAME and HTTP_AUTH_PASSWORD for convenience; Puppeteer accepts username and password string values.
Does Page.authenticate() provide a documented performance number?
No. Puppeteer warns that request interception may affect performance but publishes no numeric measurement in the cited method reference.
Quick Recap
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
