Skip to content
Ironfang

Guide

Screenshot a page behind a login

Provide the session with the render request so Chromium can load the authenticated page before capture.

Dashboards, internal tools and staging environments often require authentication. Ironfang Render can attach session cookies, bearer tokens, basic authentication and custom headers before navigation so the browser receives the authenticated page.

Ironfang Render applies headers, cookies and the authorization value before navigation so authentication is present on the first request to the page.

With a session cookie

Pass the session cookie your application already issues with the render request. The domain field is required because Chromium drops a domainless cookie before navigation. The API validates this field and returns a 400 response that identifies the invalid cookie.

curl -X POST https://api.ironfang.uk/renderwolf/v1/screenshot \
  -H "Authorization: Bearer if_live_..." \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://app.example.com/dashboard",
    "cookies": [
      { "name": "session", "value": "YOUR_SESSION_TOKEN", "domain": "app.example.com" }
    ]
  }' \
  --output dashboard.png

With a bearer token or basic auth

Use the authorization field for APIs, staging environments and other pages that read the Authorization header. Ironfang Render sends the value with requests for the page.

curl -X POST https://api.ironfang.uk/renderwolf/v1/screenshot \
  -H "Authorization: Bearer if_live_..." \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://staging.example.com/report",
    "authorization": "Bearer YOUR_APP_TOKEN"
  }' \
  --output report.png

Custom headers and user agent

Use headers for additional values such as an API key, tenant identifier or feature flag. The user_agent field overrides the browser identity, including the value set by a device preset.

{
  "url": "https://app.example.com/admin",
  "headers": { "X-Tenant": "acme", "X-Feature-Preview": "on" },
  "user_agent": "StatusBot/1.0 (+https://example.com/bot)"
}

Security limits

Private-network targets remain blocked when credentials are supplied. The SSRF guard runs before authentication data is applied, so a session cookie cannot be directed at an internal address. Ironfang Render also does not submit login forms. Provide an existing session instead of an account password.

Next