Complete the website’s normal two-factor authentication (2FA) flow with an account you are authorized to use, verify that the authenticated page is ready, and then call Puppeteer’s page.screenshot(). Puppeteer’s Page.authenticate() handles HTTP authentication credentials; it does not complete a website’s MFA challenge. Puppeteer API reference
What Puppeteer can—and cannot—do with 2FA
Puppeteer can control a browser and capture a page after access has been granted. The site determines how its second factor works, and the reviewed Puppeteer API does not provide a general-purpose method for solving MFA. Complete the sign-in using the site’s intended process, such as an authorized test account and its configured factor.
As an Amazon Associate I earn from qualifying purchases.
page.authenticate({ username, password }) is for HTTP authentication, not a website’s username/password-and-second-factor flow. Puppeteer notes that this API enables request interception behind the scenes, which may affect performance. Puppeteer: Page.authenticate()
Recommended Free Tools
Use this workflow only for pages you own or are authorized to access. The screenshot call comes after successful authentication; it is not a method for defeating a challenge or bypassing access controls.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Run an authorized login, verify it, and capture
The example below assumes the application’s normal login flow has been completed by an authorized operator or test setup. Replace the example URL and selector with application-specific values. The authenticated-page check is deliberate: a click or navigation event alone does not prove that the second factor succeeded.
const puppeteer = require('puppeteer');
(async () => {
const browser = await puppeteer.launch({ headless: true });
try {
const page = await browser.newPage();
await page.goto('https://example.com/account', {
waitUntil: 'domcontentloaded',
});
// Complete the site's authorized sign-in and 2FA flow before this check.
// Replace this selector with a stable element visible only after sign-in.
await page.waitForSelector('[data-testid="account-dashboard"]', {
visible: true,
timeout: 15000,
});
await page.screenshot({ path: 'authenticated-page.png', fullPage: true });
} finally {
await browser.close();
}
})();Install Puppeteer in your project with npm install puppeteer if it is not already installed. The sample uses CommonJS; in an ES module project, import Puppeteer using the module syntax configured for that project.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Choose a reliable success signal
Check an application-specific authenticated element, or check the expected final URL and then wait for the content you need. A selector unique to the signed-in page is often more meaningful than waiting for a generic navigation. Playwright’s official authentication guide illustrates the general browser-automation practice of verifying a final URL or authenticated element; it is not a Puppeteer-specific recipe. Playwright: Authentication
For content that loads asynchronously after the page shell appears, wait for a selector that represents the actual content to be captured. Puppeteer locators can wait for conditions such as visibility, enabled state, viewport presence, and a stable bounding box when performing interactions. Puppeteer: Page interactions
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Capture the whole page or a specific element
page.screenshot() captures the page and supports options including path, type, quality, fullPage, clip, and omitBackground. Full-page capture is not the default, so set fullPage: true when the image should include content beyond the viewport. Puppeteer: ScreenshotOptions
To capture one panel rather than the whole page, select it and use its element screenshot method:
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
const panel = await page.$('[data-testid="account-dashboard"]');
if (!panel) throw new Error('Authenticated dashboard was not found');
await panel.screenshot({ path: 'dashboard-panel.png' });An element screenshot scrolls the element into view if needed. It fails if the element becomes detached before capture. Puppeteer: ElementHandle.screenshot()
Handle authenticated state carefully
For repeated authorized tests, a saved browser state can avoid repeating interactive setup, but it must be treated as a credential. Cookies and headers in saved state may allow someone to impersonate the account. Keep state files out of source control, restrict access, and delete or rotate them when they are no longer needed. Playwright documents this risk for its own storage-state files; do not assume its format or APIs apply to Puppeteer. Playwright: Authentication
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Puppeteer’s cookie guide covers retrieving, setting, and deleting cookies. Its API reference notes that page-level cookie methods are deprecated in favor of Browser or BrowserContext methods. A cookie alone may not represent the full authenticated state: an application can depend on other browser storage or passkeys. Confirm the supported approach and state format for the Puppeteer version in your project. Puppeteer: Cookies · Puppeteer: Page API
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Troubleshoot failed or incomplete screenshots
- The screenshot shows the login or 2FA screen: The authenticated check did not succeed, or the screenshot was triggered before it did. Verify the site’s expected post-login URL or signed-in-only element before capture.
- The page is authenticated but content is missing: Navigation may have finished before asynchronous content rendered. Wait for the specific content selector or another page-specific readiness condition, not just a generic navigation event.
waitForSelectortimes out: Check that the selector exists on the authenticated page, that sign-in completed, and that the element is expected to become visible. Use a stable application selector rather than a transient layout detail.- An element screenshot reports a detached element: The page replaced or removed that element between selection and capture. Locate it again after the UI update and capture the current element.
- Capture is slower after configuring HTTP authentication: Puppeteer says
Page.authenticate()enables request interception behind the scenes, which may affect performance. Use it only when the site actually requires HTTP authentication; it does not replace website MFA.
Or skip the browser setup
If you already have authorized access to a page, ScreenshotNeo can capture it through one API request. The service is a website screenshot API and MCP server for developers. Cookie banners are accepted and removed before capture, along with known consent platforms, newsletter popups, and chat widgets; each of those cleanup steps can be turned off. Bot checks/CAPTCHAs, blank pages, timeouts, failed loads, and cache hits cost nothing, and responses report the page verdict and billing status in headers. AI agents can use its MCP server tools, including take_screenshot, get_page_info, and capture_pdf. It does not bypass authentication: provide a URL the service is authorized and able to access.
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://example.com/account -o shot.webpSee the ScreenshotNeo API documentation for request options and access-key setup. ScreenshotNeo offers 1,000 screenshots per month free with no card; paid plans start at $5 for 3,000. ScreenshotNeo. Sign up for 1,000 free screenshots a month, with no card required.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Frequently Asked Questions
Can Puppeteer enter an authenticator code automatically?
Puppeteer does not document a general MFA-solving API. Complete the site’s authorized second-factor flow, then verify the authenticated page before capturing it.
Does a screenshot include content below the visible browser area?
Not by default. Set fullPage: true for a full-page capture, or use an element screenshot for a focused page section.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
