Browshot Authentication: API Key and Security Practices (2026)

Authentication overview

Browshot's API employs a straightforward authentication model centered around a unique API key. This key serves as the primary credential for identifying and authorizing requests made to the Browshot service. Each user account is assigned a distinct API key, which must be included with every API call to ensure that requests originate from an authorized source and are associated with the correct usage plan. The API key model is a common approach for RESTful APIs, providing a balance between ease of implementation and necessary security measures for resource access.

The system relies on HTTPS for all communications, encrypting data in transit and protecting the API key from interception during transmission. This ensures that while the API key itself is a secret, its transmission over the network is secured against eavesdropping. Developers integrate this key directly into their application's code or configuration, typically as a query parameter or header, when making requests to the Browshot API endpoints for automated website screenshots, thumbnail generation, and other visual rendering tasks.

Supported authentication methods

Browshot primarily supports API key authentication. This method involves generating a unique alphanumeric string that acts as a secret token. When a client makes a request to the Browshot API, this API key is included in the request, allowing the server to verify the identity of the client and grant access to the requested resources. This approach is widely adopted for its simplicity and effectiveness in controlling API access. The API key is associated with the user's account and tracks usage against their subscription plan.

API Key

The API key is a long, randomly generated string that uniquely identifies your Browshot account. It functions as a password for your application to access the Browshot API. When an API call is made, the key is transmitted with the request to authenticate the sender. This method is suitable for server-side applications where the API key can be kept secure and not exposed to end-users. For client-side applications, careful consideration of security implications is necessary to prevent key exposure.

Table: Browshot Authentication Methods

While API keys are effective for authentication, they differ from more complex authorization frameworks like OAuth 2.0, which are typically used for delegated authorization where a user grants a third-party application limited access to their resources without sharing their primary credentials. According to the OAuth 2.0 specification, OAuth is an authorization framework, not an authentication protocol, though it can be used in conjunction with OpenID Connect for authentication purposes. Browshot's use of API keys simplifies access control for its specific service model.

Getting your credentials

To obtain your Browshot API key, you must first register for an account on the Browshot website. After successful registration and logging in, your API key will be available within your user dashboard. The process typically involves navigating to a section labeled 'API Key' or 'Account Settings'.

1. Sign Up/Log In: Go to the Browshot homepage and either create a new account or log in to an existing one.
2. Access Dashboard: Once logged in, locate your account dashboard.
3. Retrieve API Key: Your unique API key will be displayed in a dedicated section, often labeled 'API Key' or similar. It's crucial to treat this key as sensitive information.
4. Store Securely: Copy your API key and store it in a secure location, such as an environment variable or a secrets management system, rather than hardcoding it directly into your application's source code.

Browshot's official documentation provides detailed instructions on how to locate and manage your API key within your account. If you ever suspect your API key has been compromised, you should be able to regenerate it from your dashboard, invalidating the old key and ensuring continued security.

Authenticated request example

When making requests to the Browshot API, your API key must be included as a query parameter in the URL. The parameter name for the API key is typically key. Below are examples demonstrating how to make an authenticated request using the API key in different programming languages.

Python Example

This Python example uses the requests library to make a call to the Browshot API to capture a screenshot.

import requests

API_KEY = "YOUR_BROWSHOT_API_KEY"
URL = "https://api.browshot.com/api/v1/simple?url=https://www.example.com&instance_id=1&key=" + API_KEY

try:
    response = requests.get(URL)
    response.raise_for_status()  # Raise an exception for HTTP errors
    data = response.json()
    print("Screenshot data:", data)
except requests.exceptions.RequestException as e:
    print(f"An error occurred: {e}")

PHP Example

This PHP example uses file_get_contents or curl to make an authenticated request.

<?php
$apiKey = "YOUR_BROWSHOT_API_KEY";
$urlToScreenshot = "https://www.example.com";
$instanceId = 1; // Example instance ID

$apiUrl = "https://api.browshot.com/api/v1/simple?url=" . urlencode($urlToScreenshot) . "&instance_id=" . $instanceId . "&key=" . $apiKey;

// Using file_get_contents (requires allow_url_fopen enabled)
$response = @file_get_contents($apiUrl);

if ($response === FALSE) {
    echo "Error making request with file_get_contents.\n";
} else {
    $data = json_decode($response, true);
    print_r($data);
}

// Alternatively, using cURL (recommended for robust applications)
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $apiUrl);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true); // Ensure SSL certificate verification

$response = curl_exec($ch);

if (curl_errno($ch)) {
    echo 'cURL Error: ' . curl_error($ch);
} else {
    $data = json_decode($response, true);
    print_r($data);
}
curl_close($ch);
?>

In both examples, YOUR_BROWSHOT_API_KEY should be replaced with your actual API key retrieved from your Browshot dashboard. The url parameter specifies the website to screenshot, and instance_id refers to a specific Browshot instance configuration. For a comprehensive list of parameters and their usage, refer to the Browshot API reference documentation.

Security best practices

Securing your API key is paramount to maintaining the integrity and availability of your Browshot services. Adhering to security best practices helps prevent unauthorized access and potential misuse of your account.

• Environment Variables: Store your API key as an environment variable rather than hardcoding it directly into your application's source code. This practice prevents the key from being exposed if your code repository is compromised and simplifies key rotation without code changes. For example, in a Linux/macOS environment, you might set export BROWSHOT_API_KEY="your_key_here".
• Secrets Management: For more complex deployments, especially in cloud environments, use a dedicated secrets management service. Services like AWS Secrets Manager, Google Cloud Secret Manager, or Azure Key Vault allow you to securely store, retrieve, and manage API keys and other sensitive credentials. These services often provide features like automatic rotation and fine-grained access control, as detailed in the AWS Secrets Manager documentation.
• HTTPS Usage: Always ensure that all API requests to Browshot are made over HTTPS. Browshot enforces HTTPS, which encrypts the communication channel between your application and the API server, protecting your API key and other data from interception during transit. This is a fundamental principle of secure web communication, as highlighted by the Mozilla Developer Network's guide on secure contexts.
• Access Control: Implement strict access controls for anyone who has access to your API keys. Limit who can retrieve, view, or modify these credentials within your organization. Follow the principle of least privilege, granting only the necessary permissions to individuals and systems.
• Key Rotation: Regularly rotate your API keys. If Browshot provides a mechanism to regenerate your API key, utilize it periodically (e.g., every 90 days). This practice minimizes the window of exposure if a key is compromised without your knowledge.
• Monitoring and Alerting: Monitor your Browshot account for unusual activity or excessive usage that could indicate a compromised key. Set up alerts for unexpected spikes in API calls or other anomalous behavior.
• Avoid Client-Side Exposure: Never embed your Browshot API key directly in client-side code (e.g., JavaScript in a web browser or mobile application). Doing so would expose your key to anyone inspecting the client-side code, allowing unauthorized individuals to use your account.
• IP Whitelisting (if available): If Browshot offers IP whitelisting, configure it to allow API requests only from a specific set of trusted IP addresses. This adds an extra layer of security, ensuring that even if your API key is stolen, it cannot be used from unauthorized locations.

By diligently applying these security practices, developers can significantly reduce the risk of API key compromise and ensure the secure operation of their applications integrated with the Browshot API.