Skip to main content
Send your Scrinly API key in the bearer header on every request:
Keys are account-scoped. Status jobs, monitors, runs, baselines, and recipients owned by another account return 404, while a missing, invalid, or revoked key returns 401.
Keep Scrinly keys out of browser code, query strings, analytics, logs, screenshots, and webhook payloads. Public documentation intentionally does not offer query-string authentication.

​
OpenAI bring-your-own-key

Visual Style Guide requests may use an ephemeral OpenAI key:
Authorization still carries the Scrinly key. The provider key is accepted only on screenshot requests with styleGuide enabled, is synchronous-only, and is never stored, echoed, logged, or added to a queue. BYOK is intended for server-to-server calls.

​
Page credentials

For pages you are authorized to access, pass request headers through the JSON headers object and structured cookies through cookies. These values influence capture identity when screenshot caching is enabled, but cache keys contain only an opaque keyed fingerprint.