Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Send target-page headers through the screenshot provider’s documented header option, and authenticate your call to the screenshot provider separately. Those are two different HTTP requests with different credentials: your app calls the screenshot API, then its renderer requests the page you want captured.
That separation is the key to avoiding a common failure: the screenshot API call succeeds, but the image shows a login page because the target site never received the authorization header or cookie it needed.
Two requests, two sets of headers
A screenshot workflow involves at least two HTTP conversations:
- Your application to the screenshot API: authenticates your account and submits capture settings, including the target URL.
- The screenshot renderer to the target site: requests the page and any resources needed to render it. Custom headers for the captured page belong to this request.
Keep the credentials and scopes separate. A bearer token in the request header to the screenshot API proves that you can use that service; it does not automatically authenticate the renderer to a protected target page. Conversely, a target-site token forwarded to the page does not authenticate your application to the screenshot service.
#1 Best Overall
Header names and request shapes are provider-specific. One service may accept a repeatable query parameter, another an array of JSON objects, and another a JSON body. Use the provider’s documented field name and encoding rather than assuming that a parameter called headers works everywhere.
Send headers with a GET screenshot endpoint
Example: Screenshot API.net
Screenshot API.net documents a repeatable header parameter in Name: value form. Its documentation describes each capture as a single HTTP GET that returns raw image bytes. This example sends one authorization header to the screenshot service and two headers to the target page:
curl -G 'https://screenshot-api.net/v1/screenshot'
-H "Authorization: Bearer $SCREENSHOT_API_KEY"
--data-urlencode 'url=https://example.com/account'
--data-urlencode 'header=Authorization: Bearer target-token'
--data-urlencode 'header=Accept-Language: en-US'
-o shot.pngThe -H option authenticates the call to Screenshot API.net. Each --data-urlencode 'header=…' parameter is intended for the captured page. Replace the example tokens and URL with values appropriate to your environment. The target token should be stored securely and should have only the access needed for the capture.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Encoding matters
Use the client’s URL-encoding support for values containing spaces, commas, or other special characters. For example, a raw space in a query string can be interpreted as a separator or encoded inconsistently. With cURL, --data-urlencode encodes the parameter value for you. If constructing a URL manually, encode the entire header value according to the provider’s rules.
Rank #2
- Used Book in Good Condition
Do not put a production screenshot-service API key in a browser-visible image URL. Screenshot API.net explicitly warns that query-string keys can appear in page source and server logs. Prefer a server-side request with the provider’s documented authentication header where available.
Follow the provider’s exact request shape
ScreenshotCenter: JSON objects in a header array
ScreenshotCenter documents a header array made up of JSON objects, for example {"X-Request-Id":"abc123"} and {"Authorization":"Bearer token"}. It also documents separate settings for referer, user_agent, cookie, and post_data. These fields should not be treated as interchangeable: use the named option that matches what you need to send.
Screenshot API.org: GET or POST
Screenshot API.org documents both GET and POST capture modes and recommends bearer-token or X-API-Key authentication in the request headers. Its POST form is useful when a provider’s documented capture settings are more convenient to express in a JSON body, but the exact field names and accepted body structure still come from that provider’s API documentation.
Other documented header controls
Screenshots.dev documents custom headers, user agents, authentication credentials, and accept_language. HTML/CSS to Image documents additional_header_origins, a signal that headers for asset or API origins may need explicit origin configuration. These examples illustrate why a header option’s name does not establish its scope: confirm whether it applies to the top-level document, subresources, or specified origins.
Choose the right header for the job
- Authorization: Send a target-site bearer token or API credential only through the target-header mechanism. Do not confuse it with the credential that authenticates your request to the screenshot provider.
- Cookie: Use the provider’s documented cookie or session option when the target relies on a browser session. Cookie formatting, domain scope, expiry, and redirect behavior can affect whether it is accepted.
- Referer: Use a documented referer option or forwarded header when the target checks the referring page. A referer does not replace authentication.
- Accept-Language: Set this when the rendered page should use a particular language or locale. The provider may expose it as a standalone parameter rather than a generic header.
- User-Agent: A custom user agent can affect page rendering or content selection, but it does not grant access or bypass a site’s security checks.
- Correlation or application headers: Values such as request IDs can help trace a request if the target endpoint or logs use them.
Send only headers the target workflow requires. A custom header may be inappropriate for an unrelated origin, and credentials should not be propagated more widely than needed.
Check redirects and subresources, not just the first request
A protected page can load its HTML successfully while failing to load images, stylesheets, fonts, or data from other origins. Some screenshot providers forward custom headers only to the main document; others allow origin-specific configuration. HTML/CSS to Image’s additional_header_origins option is an example of an explicit origin control. Check the provider’s documentation to establish scope before relying on a header for every request.
Redirects are another boundary. A header sent to the initial host may be omitted or restricted after the page redirects to another host. That can produce a final login page or a partially rendered capture even when the first request was authorized. Inspect the final destination and determine whether the provider forwards credentials across that redirect; do not assume that it does.
Headers also do not perform an interactive login flow, create JavaScript-generated tokens, solve a CAPTCHA, or guarantee passage through a provider’s bot defenses. If the target requires one of those steps, use a provider with the required session or browser-interaction capabilities, or manage the browser workflow yourself.
Diagnose a login page or failed capture
- Verify screenshot-service authentication and endpoint. Confirm the API key is valid for the screenshot provider and that you are calling the correct endpoint and method.
- Check the rendered page’s final status. Screenshot API.net exposes
X-Page-Status. A final 401 or 403 indicates an authentication or authorization problem at the target page, even if the screenshot API returned image bytes successfully. - Match the provider’s field shape exactly. Confirm whether it expects repeated query parameters, an array, an object, or a JSON body. Check capitalization and spelling of field names, and encode values with spaces or special characters.
- Inspect the redirect destination. Determine whether the page changed host or scheme and whether the relevant header is allowed to reach that destination.
- Test protected resources separately. Check whether images, CSS, fonts, and XHR or fetch calls use other origins and whether the provider supports forwarding the required credentials to them.
- Isolate conflicts. Remove one custom header at a time and retry. A stale cookie or conflicting authorization value can change the response.
- Use short-lived target credentials where possible. Limit exposure and access if a token must be sent to a rendering service.
A returned image is not proof that the target page loaded correctly. Use the provider’s status diagnostics where available, and inspect the image itself for an error page, sign-in form, or missing content.
When to use browser automation instead
Use a hosted screenshot API when its documented header, cookie, redirect, and origin controls cover the target’s needs. If the workflow depends on per-origin routing, an interactive login, or browser state that a provider cannot express, a self-managed browser can offer more control at the cost of operating the browser runtime yourself.
Playwright’s official APIRequest reference exposes extraHTTPHeaders as an object of additional headers sent with every request in that API request context. That is a request-context feature; for a browser-rendered workflow, choose and configure the appropriate browser context and request handling for the behavior you need. With a self-managed browser, your application owns browser versions, rendering resources, concurrency, and secret handling.
Free tools Windows power users keep installed
One-click scans. No signup required.
Or skip the browser setup
ScreenshotNeo is a website screenshot API with documented custom headers, cookies, and authorization settings. For a one-call capture, the API can return an image or PDF; place target-site credentials in its documented target-header settings, separate from the ScreenshotNeo credential shown here. See the ScreenshotNeo API documentation for the available parameters and formats.
Best Value
curl -G "https://api.screenshotneo.com/v1/shot"
-d access_key=YOUR_API_KEY
--data-urlencode url=https://example.com/account
-o shot.webpCookie banners, newsletter popups, and chat widgets are removed before the shot; each step can be turned off. Bot checks, blank pages, timeouts, failed loads, and cache hits cost nothing, and response headers report the page verdict and billing status. Its MCP server lets AI agents use take_screenshot, get_page_info, and capture_pdf. The Free plan includes 1,000 screenshots per month with no card; paid plans start at $5 for 3,000 screenshots. Sign up free for 1,000 screenshots a month with no card.
Performance, reliability, and cost considerations
Custom headers do not eliminate the time required to load and render a page. Protected assets, redirects, client-side data calls, and slow target responses can all affect completion. A longer timeout may help with a genuinely slow page, but it will not fix an incorrect token, an unsupported header scope, or a blocked login flow.
For repeated captures, test with the same redirect path and resource origins used in production. If the provider supports caching, account for the possibility that a cached image reflects an earlier authorization state or page version. Avoid sharing captures or signed links containing sensitive content unless their access controls match the data’s sensitivity.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsCost models differ by provider and by what counts as a billable capture; check the provider’s published terms and response diagnostics rather than assuming a failed page is free or billable. ScreenshotNeo specifically states that only clean shots are billed, with cache hits and the listed failed outcomes costing nothing; its response includes X-Page-Verdict and X-Billed headers.
Frequently asked questions
Can a successful screenshot API response still contain a 401 page?
Yes. The screenshot service can successfully return an image of the target’s 401 or sign-in page. Check target-page status diagnostics and the rendered result rather than treating a successful API response as proof of target authentication.
Does an Authorization header automatically reach images and API calls used by the page?
No universal rule applies. Header forwarding scope depends on the provider and may be limited by origin or redirect. Confirm the documented scope and test the protected subresources.
Can I use headers to bypass a CAPTCHA or bot check?
No. Headers can provide request metadata or credentials, but they do not solve CAPTCHAs or guarantee that a target’s bot defenses will allow rendering.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallHow can an AI agent take a screenshot without custom browser code?
ScreenshotNeo provides an MCP server with take_screenshot, get_page_info, and capture_pdf tools for compatible MCP clients, including Claude and Cursor.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
