For pages you are authorized to access, the safest general workflow is to sign in through the site’s normal login flow, save the resulting browser state, and load that state in a new browser context. Reusing cookies can be enough for some sites, but a signed-in session may also depend on local storage, IndexedDB, or session storage. Use an official API when it suits the task, keep saved state secret, and stop if access is denied or revoked.
Before you automate a logged-in page
Confirm that the account holder has authorized the automated access you intend to perform. Review the site’s current terms and data rules, and prefer an official API if one is available and appropriate. Having a valid cookie does not by itself establish permission to access an account, collect particular pages, or reuse the resulting data for any purpose.
This guide uses Playwright’s JavaScript API to demonstrate the normal login-and-save workflow. The examples are a pattern, not a tested integration with a particular website: login selectors, post-login indicators, and required state vary by site. Use an account and target pages you are permitted to access, and follow documented request limits. Do not treat bypassing a denial, challenge, or access control as routine session handling.
Choose the right way to reuse login state
| Approach | Best fit | Trade-off |
|---|---|---|
| Browser automation with saved state | The login needs browser interaction, the page is JavaScript-rendered, or the application uses browser-specific state. | It follows the browser-oriented flow and can cover more of the application’s storage mechanisms. See Playwright’s authentication guide. |
| API request context with saved state | The service provides a suitable API or supported request-based login flow. | It avoids browser page interaction for API work, but depends on the API and on the state being sufficient. Playwright documents saving API request state and sharing cookies with an associated browser context at API testing. |
| Manually copied cookies in a basic HTTP client | A narrow, authorized task where you have confirmed cookie authentication is sufficient. | It is fragile if login depends on other state, and copying credentials increases the chance of leakage. Cookie-only reuse is not a universal substitute for the documented browser or API flow. |
There is no universally fastest or most reliable choice: the application’s login and state design determines the fit.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →#1 Best Overall
Save state by signing in normally with Playwright
Install Playwright for Node.js in a project, then run the setup script below. Replace the example URL, selectors, and success indicator with values for the site you are authorized to use. Keep the password in an environment variable rather than hard-coding it.
-
Install the package and browser:
npm install playwrightandnpx playwright install chromium. -
Set credentials in your shell, for example
LOGIN_USERandLOGIN_PASSWORD, and create a state directory that is excluded from version control. -
Run the login script and wait for a reliable post-login signal before saving state. A click completing is not proof that authentication succeeded.
Recommended Free Tools
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.Rank #2
Sale
HTML and CSS: Design and Build Websites- HTML CSS Design and Build Web Sites
- Comes with secure packaging
- It can be a gift option
Example save-state.mjs:
import { chromium } from 'playwright';
import { mkdir } from 'node:fs/promises';
const loginUrl = 'https://example.com/login';
const accountUrl = 'https://example.com/account';
const username = process.env.LOGIN_USER;
const password = process.env.LOGIN_PASSWORD;
if (!username || !password) {
throw new Error('Set LOGIN_USER and LOGIN_PASSWORD first.');
}
await mkdir('playwright/.auth', { recursive: true });
const browser = await chromium.launch({ headless: true });
const context = await browser.newContext();
const page = await context.newPage();
try {
await page.goto(loginUrl, { waitUntil: 'domcontentloaded' });
await page.locator('input[name="username"]').fill(username);
await page.locator('input[name="password"]').fill(password);
await page.locator('button[type="submit"]').click();
// Replace this with a stable, non-sensitive signal for your application.
await page.waitForURL('**/account', { timeout: 30000 });
await page.getByRole('heading', { name: 'Account' }).waitFor();
await context.storageState({ path: 'playwright/.auth/account.json' });
} finally {
await browser.close();
}The selectors and account heading are illustrative; use the site’s actual login fields and a dependable success condition. For applications with redirects or a dashboard that does not change URL, wait for a stable element that appears only after successful authentication. Avoid saving a state file until that assertion passes.
Protect the state file
Playwright warns: “The browser state file may contain sensitive cookies and headers that could be used to impersonate you or your test account.” Treat the file as a credential, not as ordinary test output.
- Add
playwright/.auth/to.gitignorebefore generating state; do not commit, email, paste, or publish the file. - Restrict filesystem, CI artifact, and backup access to people and services that need it. Do not print state contents or authentication headers in logs.
- If the state is exposed, revoke or refresh the associated credentials through the site’s normal account-security process.
Load saved state to capture or inspect a page
For a browser-rendered page, create a fresh context using the saved state. Verify authentication with a non-sensitive assertion before collecting content; handle a failed assertion by stopping and reauthenticating through the ordinary flow.
import { chromium } from 'playwright';
const browser = await chromium.launch({ headless: true });
const context = await browser.newContext({
storageState: 'playwright/.auth/account.json'
});
const page = await context.newPage();
try {
await page.goto('https://example.com/account/reports', {
waitUntil: 'domcontentloaded'
});
// Replace with a harmless assertion known to identify an authenticated page.
await page.getByRole('heading', { name: 'Reports' }).waitFor({ timeout: 15000 });
const title = await page.title();
const text = await page.locator('main').innerText();
console.log({ title, text });
} finally {
await browser.close();
}Choose what to extract deliberately and minimize sensitive data in output. A successful page load alone may not establish that you reached the intended authenticated view; a redirect to login, an access-denied page, or an empty shell needs to be treated as a failed check.
Rank #3
When an API request context is a better fit
If the service documents an API for the information you need, using that API is often a cleaner fit than scraping rendered markup. Playwright’s API testing documentation describes saving storage state from an API request context and sharing cookies between a browser-associated request context and its browser context.
For an API that accepts the saved state, a request context can be initialized with it:
import { request } from 'playwright';
const api = await request.newContext({
baseURL: 'https://example.com',
storageState: 'playwright/.auth/account.json'
});
try {
const response = await api.get('/api/reports');
if (!response.ok()) {
throw new Error(`API request failed: ${response.status()}`);
}
const reports = await response.json();
console.log(reports);
} finally {
await api.dispose();
}Replace the endpoint with one the service documents and authorizes. Browser state does not guarantee that an API endpoint will accept the same credentials, and a page’s private internal endpoints are not automatically a supported API. Check the response and stop if access is rejected.
Why copying session cookies may fail
Cookies are only one possible component of authentication state. Playwright’s documentation describes cookies, local storage, IndexedDB, and passkeys as possible components. Session storage is scoped to a domain and, by default, is not persisted across page loads in the same way as saved storage state; applications relying on it may require explicit handling. See the Playwright authentication documentation source.
Rank #4
- Brand: Wiley
- Set of 2 Volumes
- A handy two-book set that uniquely combines related technologies Highly visual format and accessible language makes these books highly effective learning tools Perfect for beginning web designers and front-end developers
- Cookie-only client reaches a login page: the site may depend on a token or other value in local storage, IndexedDB, or session storage.
- Login appears successful but protected content is absent: a redirect, incomplete login, or application-specific state may not have been captured. Verify a known authenticated signal before processing data.
- Saved state stops working later: sessions can expire or be invalidated. Sign in again through the normal flow and save fresh state only when authorized.
- Passkey or interactive step is required: a copied cookie may not reproduce the application’s authentication process. Use the site’s supported flow rather than trying to circumvent its controls.
Request pacing, failures, and troubleshooting
Follow the target’s documented limits and use only the pages and data within your authorization. Do not continue when permission is revoked, access is denied, or the site presents a challenge. The sources here do not establish target-specific limits or behavior, so consult the relevant service’s current documentation and rules.
| Symptom | Likely cause | Safe next step |
|---|---|---|
| Selector timeout on the login form | The example selector does not match the site, the page has not rendered that control, or the login flow differs. | Inspect the permitted page manually, use the correct visible form selectors, and wait for the actual control. Do not guess at hidden endpoints or bypass a challenge. |
| Post-login wait times out | Credentials were rejected, an additional authentication step is required, or the chosen URL/element is not the site’s success signal. | Check the normal browser flow, use a reliable authenticated-page indicator, and stop if the site denies access. |
| New context redirects to sign-in | State expired, was saved before login completed, or the application uses state not included in the file. | Confirm the state file exists and is protected, then reauthenticate normally and investigate the application’s documented storage requirements. |
| API call returns an authorization error | The endpoint does not accept browser state, the credential expired, or the route is not an authorized/documented API. | Use an appropriate documented API and its supported authentication method; do not repeatedly retry a denied request. |
| State file appears in a repository or log | Credential-handling controls were missing. | Remove exposed copies, restrict access, and revoke or refresh the session credentials through the account’s normal security controls. |
Permission and legal limits
Authorization to sign into one account is not blanket permission to collect every page or reuse its contents for any purpose. Site terms, privacy and data rules, contracts, jurisdiction, and the specific account and target matter. Review current site rules and obtain permission where needed.
Under U.S. federal law, 18 U.S.C. § 1030 includes provisions concerning access without authorization and exceeding authorized access; the statute defines “exceeds authorized access” in terms of obtaining or altering information the accessor is not entitled to obtain or alter. Read the current text at the Office of the Law Revision Counsel’s 18 U.S.C. § 1030 page, which states that it reflects law through September 26, 2026. In Van Buren v. United States, 593 U.S. 374 (2021), the Supreme Court discusses the statutory distinction between access without authorization and exceeding authorized access; it does not decide whether a particular scraping activity is lawful. The Court’s opinion is available here. This is general information, not legal advice or a determination about a specific site.
Or skip the browser setup
If your goal is a screenshot of a page you are authorized to view, ScreenshotNeo is a website screenshot API and MCP server from Yorker Media. It does not sign into accounts on your behalf or replace the authorization and state-handling steps above. For pages reachable to the service, one GET request returns an image or PDF; see the ScreenshotNeo documentation.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpReplace the example URL with the URL you are permitted to capture and supply your API key. ScreenshotNeo removes cookie/consent banners, newsletter popups, and chat widgets before the shot; bot checks, blank pages, and failed loads are never billed. An MCP server lets AI agents use the screenshot tools. The Free plan includes 1,000 screenshots a month with no card; paid plans start at $5 for 3,000. Sign up for ScreenshotNeo’s free plan.
Frequently Asked Questions
Does a session cookie prove I am allowed to scrape a page?
No. Possessing a cookie is not proof of authorization to access the account, collect the page, or reuse its data.
Can I use saved Playwright state with an API request?
Sometimes. The API must support the authentication represented by that state; verify against the service’s documented API and authentication flow.
What if the authenticated site uses session storage?
Saved state may not include it by default. Determine the application’s documented state requirements and handle session storage explicitly only where authorized.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
