Skip to main content
Authenticate REST requests with an API key in the Authorization header:
Issued keys use the sf_live_ prefix. A key must be active and recognized by the service; adding the prefix to an arbitrary string does not create a valid key.

​
Required scopes

Use the same API key to submit, recover, and inspect a job. Job lookups are checked against both account ownership and the submitting API key. Another key on the same account does not automatically grant access to the job.

​
Store keys safely

Create and label keys in the API keys console. Choose the capture-and-job permissions for a rendering integration, or job-read permission for a status-only integration. Copy a new secret before closing its reveal panel: the console does not reveal it again. Store your key in a server environment variable or secret manager. Call ScreenshotAPI from your backend. Do not place the key in frontend bundles, browser storage, URLs, or source control. Use separately labeled keys for individual integrations so you can revoke or rotate one without disrupting the others. When rotating a key, finish or reconcile its in-flight jobs before switching job lookups to the new key.

​
Authentication failures

401 unauthorized means the header is missing or malformed, or the key is invalid or revoked. 403 forbidden means a valid key lacks a required scope. Correct the credential or scope before retrying. An optional X-Request-ID header lets you supply a trace identifier containing 1–100 letters, digits, underscores, dots, or hyphens. The response echoes the effective identifier in x-request-id. It is for tracing; use Idempotency-Key to prevent duplicate submissions.

​
Agents without API-key headers

The hosted MCP endpoint also supports OAuth sign-in. A compatible client asks the user to sign in and approve scoped account access. Keep API keys for your server integrations; use the agent connection guide when your client supports OAuth discovery.