How to Use URLbox to Capture a Website Screenshot from a Chrome Extension

Use the extension to collect the active tab’s URL and capture preferences, then send them over HTTPS to your own backend. Your backend—not the publicly distributed extension—calls URLbox with the project secret and returns an image or temporary render URL. URLbox documents its API and authentication, but does not provide a Chrome-extension-specific manifest or tutorial; the architecture below is a secure implementation pattern based on its API.

How the extension-to-URLbox flow works

A Chrome extension is distributed to users who can inspect its JavaScript and package. Do not put a URLbox project secret in the extension. Keep it in trusted server code, which can authenticate API requests with a Bearer token or create a narrowly scoped signed render link.

#	Preview	Product	Price
1		GXARTS Chrome Black Front Bumper Lower Panel Extension MI6405310 6405A332HA Compatible with...	$175.49	Buy on Amazon

1. The user explicitly invokes a toolbar action or context-menu command.
2. The extension reads the active tab URL and sends it, plus a small set of allowed capture options, to your application backend over HTTPS.
3. Your backend validates the URL and options, then calls URLbox using its project secret.
4. The backend returns the image bytes or a render URL to the extension UI.

The exact Chrome permissions and manifest entries depend on how the extension obtains the URL and contacts your backend. URLbox’s reviewed documentation does not establish a universal permission list or prescribe a Chrome extension configuration.

Choose the capture scope and output

Viewport screenshot

Set url, width, height, and format to capture a browser-like viewport. Dimensions are in pixels. A compact request body might be:

#1 Best Overall

GXARTS Chrome Black Front Bumper Lower Panel Extension MI6405310 6405A332HA Compatible with Mitsubishi Outlander 2019 2020

• Fitment: Compatible with Mitsubishi Outlander 2019 2020. Ensuring compatible with original mounting points.
• Manufacturer Part Number: 6405A332HA.
• Easy Installation: Designed for a direct fit and installed using basic hand tools. No modifications are required, making the replacement process simple and easy.
• Protective Packaging: The product is securely packed with protective materials to ensure safe delivery and prevent any damage during transit.
• About us: Should you experience any issues with our product after purchase, simply reach out with a screenshot of the problem. We will assist with returns or exchanges to ensure your satisfaction!

$175.49

Buy on Amazon

{
  "url": "https://example.com/",
  "width": 1365,
  "height": 900,
  "format": "png"
}

Full-page screenshot

Set full_page to true to capture the scrolling page. URLbox describes stitched full-page rendering as accuracy-oriented and native full-page rendering as speed-oriented. Stitched capture can account for lazy-loaded content; native capture is faster but may not work as well on every site. Test the target pages, especially when they use sticky elements, lazy loading, or unusual scrolling behavior. See the URLbox screenshots guide.

Capture one element

Use selector with a CSS selector when the extension should capture a component rather than the whole page. To find a selector, open Chrome DevTools on the target page, inspect the element, and identify a stable CSS selector for it. Avoid selectors tied to transient generated class names where possible.

Choose an output path

URLbox supports render links and a JSON API. A render link is convenient for a direct image request or an image source; use a signed link for production rather than exposing an unsigned request or secret. For server-side requests and larger payloads, use JSON POST with Bearer authentication. The synchronous endpoint is /v1/render/sync; the asynchronous endpoint is /v1/render/async. Choose synchronous rendering for a simple one-off capture that can wait for the result, and asynchronous rendering for longer-running or parallel jobs. API details are in the URLbox Quick Start and API reference.

Build the secure backend request

URLbox documents the API base as https://api.urlbox.com and API authentication as Authorization: Bearer YOUR_URLBOX_SECRET. The following Node.js example shows the backend pattern. Replace the route or framework wrapper as needed; keep URLBOX_SECRET in server-side environment configuration, never in extension code.

const allowedFormats = new Set(["png", "jpeg", "webp"]);

async function captureWithUrlbox(input) {
  const target = new URL(input.url);
  if (target.protocol !== "https:" && target.protocol !== "http:") {
    throw new Error("Only HTTP and HTTPS URLs are allowed");
  }

  const width = Math.min(Math.max(Number(input.width) || 1365, 320), 2560);
  const height = Math.min(Math.max(Number(input.height) || 900, 240), 3000);
  const format = allowedFormats.has(input.format) ? input.format : "png";

  const response = await fetch("https://api.urlbox.com/v1/render/sync", {
    method: "POST",
    headers: {
      "Authorization": `Bearer ${process.env.URLBOX_SECRET}`,
      "Content-Type": "application/json"
    },
    body: JSON.stringify({
      url: target.toString(),
      width,
      height,
      format,
      ...(input.full_page === true ? { full_page: true } : {}),
      ...(typeof input.selector === "string" && input.selector.length <= 300
        ? { selector: input.selector }
        : {})
    })
  });

  if (!response.ok) {
    throw new Error(`URLbox request failed with HTTP ${response.status}`);
  }
  return await response.json();
}

This example validates basic URL protocol and bounds common options; it is not a complete defense against server-side request forgery. In production, restrict schemes and destinations to your product’s needs, reject localhost and private-network destinations where appropriate, limit request size and concurrency, and avoid turning the endpoint into an unrestricted rendering proxy. Also enforce authentication and rate limits for your own extension backend.

Connect the Chrome extension UI

Obtain the URL only when the user invokes the capture action. A minimal Manifest V3 event-handler pattern can use activeTab to access the active tab after an explicit user gesture and send the URL to your own backend. This is an example for that architecture, not a URLbox-prescribed manifest.

// Relevant manifest permissions for this example only:
// "permissions": ["activeTab"]
// Host permission for your backend is also needed, for example:
// "host_permissions": ["https://app.example.com/*"]

chrome.action.onClicked.addListener(async (tab) => {
  if (!tab.url || !/^https?:///i.test(tab.url)) return;

  const response = await fetch("https://app.example.com/api/captures", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({
      url: tab.url,
      width: 1365,
      height: 900,
      format: "png"
    })
  });

  if (!response.ok) {
    // Show an error in the extension UI rather than silently failing.
    console.error("Capture request failed", response.status);
    return;
  }

  const result = await response.json();
  // Display result.imageUrl or handle the returned image according to your API.
  console.log(result);
});

For a production extension, present a clear progress or error state, and define what the backend returns. If it returns binary image bytes, the extension can display them in its own UI after receiving them. If it returns a URL, treat it according to the lifetime and access characteristics described below.

Protect credentials and constrain requests

Keep the project secret server-side

URLbox’s quickstart documents JSON API authentication with a Bearer token. A distributed extension is not a trusted place for that token: users can inspect extension files and network traffic. Store the secret in backend configuration and avoid logging it.

Use signed render links only from trusted code

URLbox’s quickstart also describes secure render links made by signing the query-string options with HMAC-SHA256 using the secret key. If you choose this path, have the backend generate signatures only for validated, constrained options. Do not let the extension supply a signature or arbitrary signed parameters.

Prevent proxy abuse

Accept only the options the feature actually needs. Validate the destination URL and impose size, rate, and concurrency limits. Consider whether the extension should capture only user-selected public pages; allowing arbitrary destinations can expose your backend to abuse. URLbox describes its bot as handling customer-initiated renders and not following links or spidering a site; that description is on its bot information page.

Handle results and retention

The synchronous JSON route can return a render URL that expires after 30 days, according to the URLbox Quick Start. That is suitable for temporary viewing, not durable storage. If a user needs access beyond that period, download and retain the image in storage you control, or configure cloud storage as part of the workflow. Decide whether the extension receives image bytes or a temporary URL based on how it displays and retains captures.

Troubleshoot common failures

• Unauthorized response: Check that the backend is using the correct project secret in the Bearer authorization header. Confirm the secret is available in the server environment and has not been accidentally placed only in the extension.
• Capture request rejected: Validate that the request contains a supported HTTP or HTTPS URL and valid options. Ensure the backend constructs the API request in the format required by the chosen JSON endpoint.
• Extension cannot call its backend: Check that the extension’s host permissions cover your backend origin, the endpoint is reachable over HTTPS, and your server’s CORS and authentication behavior matches the extension architecture.
• Full-page output misses content: Sites may load content only after scrolling or use complex sticky layouts. Test stitched and native modes on the relevant pages and select the mode that meets the capture’s accuracy or speed needs.
• Selector capture is empty or wrong: Recheck the CSS selector against the live page in DevTools. The element may be rendered conditionally, or its class may change between visits.
• Previously returned URL no longer works: The quickstart’s render URL lifetime is 30 days. Store the image or use configured cloud storage for longer retention.
• Slow or failed extension experience: Show progress and surface backend/API errors instead of leaving the toolbar action without feedback. For jobs that may take longer or run in parallel, use the asynchronous route and design a completion/status flow.

Performance, reliability, and cost decisions

Viewport captures generally request less page content than full-page captures. Full-page stitched mode prioritizes accuracy, while native full-page mode prioritizes speed; the right choice depends on the site and whether complete coverage or faster completion matters more. Use the async workflow when captures should not hold a single extension request open for a long render or when work is parallelized.

URLbox’s product page states that a seven-day free trial is available; this is a vendor-published offer, so check the current terms on the URLbox site. The reviewed documentation does not establish a universal per-capture cost for this implementation, so estimate cost from the plan and billing terms applicable to your account rather than assuming every render path has the same price.

Or skip the browser setup

If you do not need to build the extension-to-backend flow, ScreenshotNeo provides a screenshot API and MCP server. Its one-call API example is:

curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://example.com -o shot.webp

See the ScreenshotNeo docs for request options. Cookie banners are accepted and removed before capture, along with known consent platforms, newsletter popups, and chat widgets; those cleanup steps can be turned off. Bot checks, blank pages, timeouts, failed loads, and cache hits are not billed. An MCP server gives AI agents tools to take screenshots, inspect page information, and capture PDFs. The free plan includes 1,000 shots per month with no card; paid plans start at $5 for 3,000 shots.

Sign up for ScreenshotNeo free: 1,000 screenshots a month, no card required.

Quick Recap

Bestseller No. 1

GXARTS Chrome Black Front Bumper Lower Panel Extension MI6405310 6405A332HA Compatible with Mitsubishi Outlander 2019 2020

Manufacturer Part Number: 6405A332HA.

$175.49

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.