Authentication

Send your API key in the Authorization header, use access_key for GET requests in image tags, and keep the key out of browser code.

Send the key in a header#

Every request needs your key. Send it as a bearer token:

Authorization: Bearer sk_live_...

A missing or wrong key returns 401 UNAUTHORIZED.

GET requests and image tags#

Every endpoint also accepts GET with the options as query parameters. For GET you can pass the key as access_key, so a screenshot URL works directly in an <img> tag:

<img src="https://rendersbolt.com/v1/screenshot?url=https://github.com&viewport_width=1200&viewport_height=630&format=webp&access_key=sk_live_...">

Warning

Anyone who can see that URL can use your key. Only do this on pages that you alone see, such as an internal dashboard. For public pages, call the API from your server and serve the stored image.

Keep the key on your server#

Read the key from an environment variable or your secret manager.
Don't commit it to Git and don't ship it in front-end code. The API accepts calls from browsers, but a key in a web page can be copied by anyone.

Rotate a key#

Sign in to the dashboard and choose Rotate key. The new key works immediately and the old one stops at the same moment, so update your servers first. Your plan and usage stay the same.

Lost your key#

Keys are shown once and are not stored in readable form. Write to [email protected] from the address you signed up with and we'll issue a new one.

Stuck? Write to [email protected] with the request you sent and the error code you got back.