Signed URLs

curl -X POST https://screenshotapi.to/api/v1/screenshot/sign \
  -H "x-api-key: $SCREENSHOTAPI_KEY" \
  -H "content-type: application/json" \
  -d '{
    "params": { "url": "https://example.com", "width": "1200", "fullPage": "true" },
    "expiresInSeconds": 3600
  }'

const res = await fetch('https://screenshotapi.to/api/v1/screenshot/sign', {
	method: 'POST',
	headers: {
		'x-api-key': process.env.SCREENSHOTAPI_KEY,
		'content-type': 'application/json'
	},
	body: JSON.stringify({
		params: { url: 'https://example.com', width: '1200', fullPage: 'true' },
		expiresInSeconds: 3600
	})
})

const { url, expiresAt } = await res.json()

import os, requests

res = requests.post(
    "https://screenshotapi.to/api/v1/screenshot/sign",
    headers={"x-api-key": os.environ["SCREENSHOTAPI_KEY"]},
    json={
        "params": {"url": "https://example.com", "width": "1200", "fullPage": "true"},
        "expiresInSeconds": 3600,
    },
)

signed = res.json()["url"]

import { createHash, createHmac } from 'node:crypto'

function signScreenshotUrl(apiKey, params, expiresInSeconds = 3600) {
	const signingSecret = createHash('sha256').update(apiKey).digest('hex')

	const url = new URL('https://screenshotapi.to/api/v1/screenshot')
	for (const [key, value] of Object.entries(params)) {
		url.searchParams.set(key, String(value))
	}
	url.searchParams.set('keyPrefix', apiKey.slice(0, 12))
	url.searchParams.set(
		'expires',
		String(Math.floor(Date.now() / 1000) + expiresInSeconds)
	)

	const canonical = new URLSearchParams(
		[...url.searchParams.entries()].sort(([a], [b]) => a.localeCompare(b))
	).toString()

	url.searchParams.set(
		'sig',
		createHmac('sha256', signingSecret).update(canonical).digest('hex')
	)
	return url.toString()
}

const src = signScreenshotUrl(process.env.SCREENSHOTAPI_KEY, {
	url: 'https://example.com',
	width: 1200
})

import hashlib, hmac, string, time
from urllib.parse import urlencode

# The canonical string is serialised with the URL-encoded form rules the API uses.
# Python's urlencode() is not interchangeable here: it leaves "~" unescaped and escapes "*".
_SAFE = set(string.ascii_letters + string.digits + "*-._")


def _encode(value: str) -> str:
    out = []
    for byte in value.encode("utf-8"):
        char = chr(byte)
        if char in _SAFE:
            out.append(char)
        elif char == " ":
            out.append("+")
        else:
            out.append("%%%02X" % byte)
    return "".join(out)


def sign_screenshot_url(api_key: str, params: dict, expires_in_seconds: int = 3600) -> str:
    signing_secret = hashlib.sha256(api_key.encode()).hexdigest()

    query = {str(k): str(v) for k, v in params.items()}
    query["keyPrefix"] = api_key[:12]
    query["expires"] = str(int(time.time()) + expires_in_seconds)

    canonical = "&".join(f"{_encode(k)}={_encode(v)}" for k, v in sorted(query.items()))
    query["sig"] = hmac.new(
        signing_secret.encode(), canonical.encode(), hashlib.sha256
    ).hexdigest()

    return "https://screenshotapi.to/api/v1/screenshot?" + urlencode(query)