EXPRESS INTEGRATION

Put screenshot capture behind a small, secure Express service

Authenticate your application caller, resolve or validate the destination, call Snapshot Site from Node.js, and return an application-owned job or asset. The private provider key never enters browser code.

Express route
Trusted boundary
Validation
Approved targets
Worker-ready
Queue integration
Install:npm install express
Auth:SNAPSHOT_SITE_API_KEY
Get started for free
Express screenshot service
Snapshot Site themed Express screenshot API illustration
Good fits
Node.js backends generating page previews
SaaS products exposing authorized capture jobs
Queue workers archiving rendered pages
Internal services normalizing screenshot operations

An Express route should own policy, not just proxy bytes

A safe integration authenticates its caller, validates the business target, applies a capture specification, checks provider response, and controls result access.

1

Application auth

Confirm which signed-in user or service may create a capture and spend quota.

2

Destination mapping

Prefer product entity IDs resolved to known URLs over arbitrary input.

3

Normalized transport

Centralize request fields, timeout, status handling, and safe diagnostics.

4

Durable job

Use a queue and idempotent storage when capture should survive the HTTP request.

Implementation workflow

Create an Express capture endpoint

1

Load the API key from server-side secret management

2

Authenticate the caller and resolve an approved page ID

3

Call Snapshot Site with an explicit capture specification

4

Validate, store, and return an application-owned result

Express screenshot API example

Node.js

Capture a known application page

The route maps a page ID to a trusted URL and never accepts the provider key from the client.

import express from "express";

const app = express();
app.use(express.json());

const pages = new Map([
  ["pricing", "https://example.com/pricing"],
  ["docs", "https://example.com/docs"],
]);

app.post("/captures", async (req, res) => {
  const url = pages.get(req.body.pageId);
  if (!url) return res.status(400).json({ error: "Unknown page" });

  const response = await fetch(
    "https://api.prod.ss.snapshot-site.com/api/v1/screenshot",
    {
      method: "POST",
      headers: {
        "Content-Type": "application/json",
        "x-snapshotsiteapi-key": process.env.SNAPSHOT_SITE_API_KEY,
      },
      body: JSON.stringify({
        url,
        format: "webp",
        width: 1440,
        height: 900,
        fullSize: true,
        hideCookie: true,
      }),
    },
  );

  const body = await response.json();
  return res.status(response.ok ? 200 : 502).json(body);
});

Avoid building an open screenshot proxy

An endpoint that forwards any submitted URL and returns provider output exposes quota, network reach, and artifacts without product context. A useful Express service accepts an authenticated business request, such as a report or page ID, and resolves the destination under server policy.

This also produces better audit records. The job can reference the product entity rather than only a string URL.

Separate web requests from durable work

Synchronous capture is simple for a low-volume interaction that fits the request budget. A queue is more reliable for batches, scheduled jobs, retries, or expensive downstream storage. Create the job first, return its identifier, and let a worker own provider execution.

Make worker behavior idempotent. A timeout can occur after the provider completed, and a redelivery should not create an unexplained second artifact.

Normalize the provider boundary

Keep endpoint URLs, authentication headers, request serialization, response validation, timeout, and error mapping in one module. Controllers should describe business intent rather than repeat transport details.

Redact the provider key and signed target parameters. Store generated files under application access rules, and preserve page identity, revision, viewport, format, readiness, and capture time.

The Node.js save tutorial covers durable asset import, while request parameters documents how to construct an explicit specification.

Screenshot API for Express FAQ

Can Express call Snapshot Site directly?

Yes. Make the provider request from the Express server or a worker, where the API key remains private.

Should my endpoint accept a raw URL?

Prefer internal page IDs resolved by the server. If raw URLs are required, enforce protocol, hostname, network, and product policy.

How should the route authenticate users?

Use the application's existing authentication and authorization before accepting capture work. Provider authentication does not authorize your users.

Should the request wait for capture to finish?

Small jobs can be synchronous. Use a queue and status endpoint for variable latency, batches, retries, or work that must survive a client disconnect.

How should errors be returned?

Map validation, authorization, provider, target, and storage failures into stable application categories without exposing secrets.

Can I cache identical captures?

Use a key built from source identity, revision, viewport, format, and preparation settings when the product allows reuse.

How do I prevent duplicate jobs?

Assign an idempotency key or uniqueness rule to the logical capture and make storage safe for retries.

What belongs in logs?

Record internal job ID, operation, timing, safe target identity, status category, and attempt while redacting credentials and signed URLs.

Build one policy-aware Express route

Start with a server-resolved page identifier and explicit capture settings before accepting broader input.