In Puppeteer, sourceScheme records the scheme of the origin that originally set a cookie. It is metadata about the cookie’s source, not another name for the cookie’s Secure flag. Puppeteer documents three values: Unset, NonSecure, and Secure.
What sourceScheme means
Puppeteer describes CookieSourceScheme as the source scheme of the origin that originally set the cookie. In other words, the field characterizes the cookie’s originating context; it is distinct from the cookie’s own security attribute. The field is optional in Puppeteer’s cookie-setting and cookie-data types, and Puppeteer documents it as supported only in Chrome. Puppeteer’s CookieSourceScheme reference defines the type, while the CookieParam reference and CookieData reference describe the API fields.
As an Amazon Associate I earn from qualifying purchases.
What the three values indicate
| Value | Meaning and practical note |
|---|---|
Secure |
Indicates a secure source scheme for the origin associated with the cookie’s source. It does not mean the same thing as setting the cookie’s separate secure property to true. |
NonSecure |
Indicates a non-secure source scheme for the origin associated with the cookie’s source. |
Unset |
A temporary compatibility value that lets protocol clients emulate legacy cookie scope for the scheme. Puppeteer says this ability will be removed in the future, so do not treat it as a durable default. |
The Chrome DevTools Protocol also marks sourceScheme experimental. Its live protocol definition can change: Network.pdl.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
sourceScheme versus secure
These are separate cookie properties. secure is the cookie’s Secure flag; sourceScheme describes the scheme of the origin associated with where the cookie was originally set. The protocol defines them independently, so setting one should not be understood as setting or overriding the other. The cited references do not establish that sourceScheme alone determines whether a cookie is sent with a request.
#1 Best Overall
Setting a cookie in Puppeteer
A setting URL can affect default cookie values for domain, path, and source scheme. For ordinary use, let the setting context establish appropriate defaults unless you have a specific protocol-level reason to provide sourceScheme explicitly.
await page.setCookie({
name: 'session',
value: 'example',
url: 'https://example.test',
secure: true,
sourceScheme: 'Secure',
});This is an illustrative example of the API shape, not a claim that the code has been executed. The field’s availability is Chrome-only in Puppeteer’s documentation; check the exact Puppeteer and Chrome versions used by your application before relying on it.
Rank #2
When to inspect the field
- If a cookie object received from Chrome or a protocol-level API includes
sourceScheme, read it as information about the scheme of the origin that originally set that cookie. - If you explicitly set it, confirm that the Chrome and Puppeteer versions in your environment support the property.
- If cookie behavior is unexpected, inspect the independent cookie properties too:
secure,sameSite, domain, path, and the URL used to set the cookie. The cited documentation does not saysourceSchemeoverrides these fields.
Or skip the browser setup
If your goal is to capture a page rather than inspect Puppeteer cookie metadata, ScreenshotNeo provides a website screenshot API and MCP server. A single GET request can return an image or PDF. Its API accepts cookie and request settings, but it is not a replacement for Puppeteer’s cookie APIs or a way to inspect sourceScheme.
For a screenshot, this cURL call saves the result as a WebP file. See the ScreenshotNeo API documentation for request options.
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webp- Cookie banners are accepted and removed, along with known newsletter popups and chat widgets, before capture; each step can be turned off.
- Bot checks, blank pages, timeouts, failed loads, and cache hits cost nothing; response headers report the page verdict and whether the request was billed.
- An MCP server provides screenshot tools for AI agents, including Claude, Cursor, and other MCP clients.
- The Free plan includes 1,000 screenshots per month with no card; paid plans start at $5 for 3,000 screenshots.
Sign up for 1,000 free screenshots a month—no card required.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Frequently Asked Questions
Is sourceScheme required when setting a Puppeteer cookie?
No. Puppeteer documents it as optional; a setting URL can affect its default value.
Does sourceScheme: 'Secure' set the cookie’s Secure flag?
No. The source-scheme field and the cookie’s secure flag are distinct properties.
Recommended Free Tools
Can I rely on Unset for new code?
It is described as a temporary legacy-compatibility ability that will be removed, so it is not a durable default.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
