You cannot keep a secret screenshot API key secret in code delivered to a browser. Put the key in server-side secret storage, have your frontend call an endpoint you control, and let that endpoint validate and limit screenshot requests before calling the provider. The browser should never receive the upstream key.
Why a frontend cannot hide a secret key
Anything delivered to a user’s browser can be inspected or changed: JavaScript bundles, HTML, browser storage, client-visible configuration, and network requests. Obfuscation, minification, and hiding a button may make a key less obvious, but do not make it secret. OWASP’s Web Frontend Security Cheat Sheet puts the rule plainly: “Anything sent to the client can be read or modified by the user, so keep all that secret stuff on the server please.”
This applies to build-time environment variables too. If a framework embeds a variable in the browser bundle, it is public regardless of whether its name looks private. A client-only app that directly calls a screenshot provider with a shared secret cannot protect that credential.
Use a server-side endpoint as the security boundary
Place a server route, serverless function, or backend-for-frontend (BFF) between the browser and the screenshot service. The browser sends only the inputs your app permits to your endpoint. Your server authenticates and authorizes the caller as needed, validates those inputs, applies usage controls, then calls the provider with the secret. It returns only the allowed screenshot result or a controlled error.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Store the key server-side. Put it in deployment secret configuration or a secrets vault. Do not serialize it into HTML, expose it through public build-time variables, or send it in a response. OWASP’s Protect Data Everywhere guidance recommends protecting application secrets and using a proper secrets vault.
- Define a narrow browser request. Accept only the fields needed for your product’s allowed operation, such as an approved target URL or permitted output settings. Validate URL, dimensions, format, and any other options on the server against your own rules and the provider’s current API.
- Authenticate and authorize on the server. Where appropriate, verify the caller’s session or token and decide which operations that caller may perform. Do not trust a user ID, role, or permission merely because frontend code submitted it.
- Call the provider from your server. Read the secret from server-side configuration and send it using the provider’s supported authentication method. Avoid placing credentials in URLs or query strings when a supported header or request body is available.
- Return a limited result. Send back only what the frontend needs. Do not pass provider credentials, internal configuration, or unrestricted provider error details to the browser.
The exact request fields and authentication header depend on the screenshot provider. Check its current official API documentation rather than guessing the authentication scheme.
Constrain requests, access, and cost
Your proxy is a billable resource. Moving the key server-side stops direct key theft from the bundle, but it does not by itself stop an authorized or abusive caller from using your endpoint to trigger screenshots.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Validate and constrain inputs: allow only the URLs, viewport sizes, output types, and provider options your product needs. Do not forward arbitrary headers or arbitrary provider operations supplied by the browser.
- Apply caller-level controls: enforce authorization and per-user or per-tenant quotas server-side. A hidden button or client-side rate check is not an access-control mechanism.
- Rate-limit and monitor: set request limits, watch usage and failures, and return HTTP 429 when requests arrive too quickly. OWASP’s REST Security Cheat Sheet recommends throttling and discusses revoking keys when clients violate usage agreements.
- Keep credentials out of URLs: URLs can be captured in server logs. OWASP’s REST guidance warns against URL-based credentials; use the provider’s supported header or body authentication method instead.
- Plan for revocation: restrict who can read the server-side secret, monitor use, and know how to revoke or rotate it if exposed or misused.
What CORS does—and does not—protect
Cross-origin resource sharing (CORS) can tell browsers which origins may read responses from your endpoint. It is not a way to hide an API key, and it does not replace authentication, authorization, input validation, or rate limits. A key embedded in browser code remains visible even if the provider’s CORS policy blocks some requests. Keep the key on your server and enforce the rules at your endpoint. OWASP describes CORS as a browser cross-origin control, not a credential-secrecy mechanism, in its REST Security Cheat Sheet.
Choose the integration model that fits your app
| Approach | Does it keep a shared upstream key out of the browser? | Who controls screenshot access? | Main trade-off |
|---|---|---|---|
| Direct provider call from frontend with a secret key | No. The key can be read from delivered code or browser traffic. | Not reliably; a client-side check can be modified. | Simple wiring, but unsuitable for a shared secret credential. |
| Your server route, serverless function, or BFF | Yes, if the key stays server-side and is never returned to the client. | Your server can authenticate callers, validate operations, and enforce limits. | Requires server-side code, secret configuration, and operational controls. |
| Provider-supported public or restricted browser credential | Only if the provider explicitly designed that credential for browser use and documents its restrictions. | Depends on the provider’s supported restrictions and your application controls. | Availability and protections are provider-specific; verify them in current official documentation. |
If your app has no trusted server-side component, introduce one, use a provider-supported browser credential only if the provider explicitly offers it for that purpose, or choose a different integration model. OAuth guidance likewise treats browser-based applications as public clients; a BFF can keep tokens server-side. See OAuth 2.0 for Browser-Based Apps.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #3
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
If the key has already been exposed
- Revoke or rotate the exposed credential in the provider’s account or key-management controls.
- Update the server-side secret configuration with the replacement, then verify the server endpoint works without exposing the new value to the browser.
- Review provider usage and your own logs for unexpected requests or costs; apply tighter quotas or restrictions if needed.
- Remove the old key from current source and build configuration, and address any repository history or distribution paths that still contain it. Deleting it from the latest source does not make the old credential secret again.
OWASP’s REST guidance identifies revocation as a response to key misuse; rotating a key after exposure is prudent incident response.
Troubleshooting
- The key appears in DevTools or the built JavaScript: it is client-exposed. Remove it from frontend configuration, rotate it, and make the provider call from a server-side endpoint.
- The browser request fails after moving the call server-side: check the server’s secret configuration and the provider’s documented authentication format. Do not fix this by sending the key back to the browser.
- A request works for one user but not another: inspect server-side session validation, authorization rules, and per-user or per-tenant quota handling. Do not accept a frontend-supplied identity as proof of access.
- Requests are still expensive or excessive: add or tighten server-side rate limits, quotas, input constraints, and usage monitoring. Client-side throttling alone can be bypassed.
- CORS errors persist: configure the browser-facing endpoint’s allowed origins for your app, but keep authentication and authorization in place. CORS does not make the upstream key secret.
Or skip the browser setup
If you want to avoid building a browser automation or screenshot-provider integration, ScreenshotNeo offers a website screenshot API and MCP server. Keep its API key on your server just as you would any other secret; do not put it in frontend code. The one-call cURL example below requests a WebP screenshot of the target page. See the ScreenshotNeo API documentation for authentication and available options.
Rank #4
- FIDO2 SECURITY KEY: A versatile, tamper-evident USB-C authentication device with sensitive presence detection for online security. FIDO 2.0 level 1 and U2F certified
- PASSWORDLESS CONVENIENCE: Replace frustrating passwords with a simple 4-digit PIN for accessing apps and sites. Seamlessly login to web apps and Windows sessions
- BROAD COMPATIBILITY: Works with Windows, Mac, Linux, Apple, iOS, iPhone, Android and USB-C devices. Seamlessly integrates with Identity Providers or Credential Management Systems supporting FIDO2, including Thales, Microsoft, AWS, and Google
- ENHANCED USER ADOPTION: Features a sensitive presence detector on the USB key, providing ease of use and superior security. Certified for U2F and FIDO2, ideal for individuals who want to secure access to their personal online accounts - Microsoft, Google, Twitter, Facebook, GitHub
- THALES: We offer a wide range of FIDO authenticators, providing robust, phishing-resistant MFA that comply with stringent regulations. With almost three decades of experience, Thales is a pioneer in passwordless authentication devices, supported globally by the FIDO Alliance and industry analysts
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpScreenshotNeo accepts cookie and consent banners and removes more than 60 known consent platforms, newsletter popups, and chat widgets before capture; each step can be turned off. Bot checks, blank pages, failed loads, timeouts, and cache hits are not billed, and responses identify the page verdict and billing status in headers. Its MCP server provides take_screenshot, get_page_info, and capture_pdf tools for Claude, Cursor, and other MCP clients. The free plan includes 1,000 screenshots per month with no card; paid plans start at $5 for 3,000 screenshots.
Sign up for 1,000 free screenshots a month, with no card required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
