FAQ · Updated October 13, 2026
Can I capture authenticated or internal pages?
For a publicly reachable page behind login, pass a JSON cookies array, a JSON headers object with the required Authorization header, or a short-lived URL issued by your application. The hosted service cannot reach your laptop, VPN, or private network. The current URL validator also rejects localhost and private IP addresses, including in the default self-hosted build. A private-network deployment needs an explicitly reviewed access configuration; running Docker alone does not remove that restriction.
Public pages behind login
Pass cookies as a JSON array through cookies, or an Authorization header as a JSON object through headers. URL-encode JSON values when constructing a GET request. The API key authenticates you to SnapshotFlow; the cookies or headers authenticate the rendering browser to the target website.
cookies=[{"name":"session","value":"YOUR_SESSION","domain":"app.example.com"}]
headers={"Authorization":"Bearer YOUR_TARGET_TOKEN"}For HTTP Basic authentication, use an Authorization header with the appropriate Basic value. There are no http_auth_user or http_auth_pass parameters. A short-lived signed URL issued by your own application is another option.
Localhost, VPN, and private addresses
The hosted renderer cannot reach a service on your laptop or behind your VPN. The URL validator rejects localhost, loopback, and private IP addresses. Those checks also exist in the default self-hosted build, so starting Docker inside your network does not automatically enable private-address capture.
For development, use a controlled, publicly reachable preview with suitable authentication. If you need private-network rendering, review the deployment and access policy explicitly rather than assuming the default service can access every internal host.
Handle credentials and files carefully
Use scoped credentials and a backend request rather than placing tokens in public JavaScript. Custom headers can be applied to resource requests as well as the main page, so consider which assets the page loads. Treat screenshot download links as credentials and save sensitive output only where your data-handling requirements allow it. Self-hosting gives you infrastructure control; it does not by itself establish a compliance certification.