React is the interface, not the secret holder
The useful React pattern is intentionally small. A component starts a capture and displays its status; an authenticated server owns the provider credential and destination policy. This arrangement works whether the backend is Node.js, PHP, Go, or a serverless function.
Avoid accepting arbitrary URLs when a page identifier will do. Resolving a known report, product, or campaign ID into a URL on the server sharply reduces abuse risk and makes audit records more meaningful.
Capture the state users actually see
A React route may render its shell immediately while the meaningful chart or catalog arrives later. Test with representative data and choose readiness based on the intended proof. An oversized delay hides timing problems and makes every job slower.
Responsive captures also require a defined width. Store that width with the result so reviewers can distinguish a mobile state from a desktop regression.
Operational design
Return normalized job states to the UI: queued, processing, ready, or failed. Keep raw provider responses in protected logs, while user-facing errors explain what action is possible. Apply limits per account and deduplicate identical jobs when repeated clicks would create unnecessary captures.
The Next.js integration shows a framework-specific server route. For a language-neutral contract, start with the REST screenshot API.