Cookie domain mismatch
A cookie without Domain is anchored to the capture URL; an incorrect Domain prevents login.
Authenticated pages
Screenshot pages that require a login
Dashboards, admin panels and per-customer views — captured with the same session your user would have.
Capture settings
Enter the source, choose your options, then run the capture.
Result
Your capture will appear here and stay in view.
waiting
No result yet
Complete the settings and run the tool. Images, PDFs, text, and video all preview in this panel.
Send this exact request
cURL, TypeScript and Python are generated from the same configuration as the demo.
curl --fail-with-body "https://api.pagecapture.dev/v1/take" \
-H "X-Access-Key: $PAGECAPTURE_KEY" \
-H "Content-Type: application/json" \
--data '{"format":"png","wait_for_selector":"[data-report-ready]","url":"https://pagecapture.dev/api/fixtures/authenticated-report","authorization":"Bearer pagecapture-public-fixture"}' \
-o capture.pngCookies, headers, Authorization
Sent exactly as you specify. Without an explicit Domain, a cookie is anchored to the URL you are capturing.
Encrypted and destroyed
Credentials are separated before storage, encrypted with AES-256-GCM, decrypted only in the worker and destroyed with the job.
Never in a log
They do not appear in the request log, the normalized options, or any error message.
Cached without leaking
The cache key includes a hash of your credentials, so two sessions never share a result — and the values stay out of the key.
Use this when
- Your backend already has a scoped session or token for the page.
- A dashboard or per-customer report has a deterministic ready state.
Do not use this when
- The login requires interactive MFA or human challenge completion.
- The credential cannot be scoped and rotated for server-side use.
Workflow
From input to verified artifact
- 01
Send by POST
Credentials belong in the encrypted request body, never a query string.
- 02
Open isolated context
The worker applies the session only inside the job browser context.
- 03
Destroy secrets
Credential records are removed when the job reaches a terminal state.
DIY in hours and operational risk
Keep the browser when that is the simpler system.
DIY can be preferable when the browser session must remain interactive for a long workflow.
DIY is a good fit when
- • The user drives the browser or completes MFA during the session.
- • A dedicated internal browser already lives inside the same trust boundary.
No default is supplied: we do not invent engineering-hour savings.
Responsibility and risk transferred
Secret lifecycle
Tokens can leak into logs, query strings, presets or browser reuse.
Context isolation
Reused browser state can expose one customer session to another job.
Workload pricing
1,000 authenticated reports
This is an editable scenario, not a savings claim. Only successful captures that miss cache are billable.
- Billable successes
- 970
- Smallest included plan
- Basic
- Published monthly price
- $10.00
Tested and reviewed
Written by PageCapture Engineering. Reviewed by PageCapture API maintainers. Last tested 2026-08-11.
cURL, TypeScript and Python executed against controlled fixtures; request contract and artifact format verified.