Signed Requests

import { writeFile } from "node:fs/promises";
import crypto from "node:crypto";

const accessKey = "YOUR_ACCESS_KEY";
const secretKey = "YOUR_SECRET_KEY"; // keep this secret
const targetUrl = "https://example.com/";

// Base endpoint (no query yet)
const endpoint = new URL("https://api.screenshotscout.com/v1/capture");

// 1) Build params you will send
const params = new URLSearchParams();
params.set("access_key", accessKey);
params.set("url", targetUrl);

// 2) Build canonical query string (sorted, without `signature`)
function buildCanonicalQuery(params) {
  const entries = [];
  let i = 0;

  for (const [key, value] of params) {
    if (key === "signature") continue;
    entries.push([key, value, i++]);
  }

  entries.sort((a, b) => {
    if (a[0] === b[0]) return a[2] - b[2]; // preserve order for duplicates
    return a[0] < b[0] ? -1 : 1;
  });

  const usp = new URLSearchParams();
  for (const [key, value] of entries) usp.append(key, value);
  return usp.toString();
}

const canonicalQuery = buildCanonicalQuery(params);

// 3) Compute HMAC-SHA256(secretKey, canonicalQuery) as lowercase hex
const signature = crypto
  .createHmac("sha256", secretKey)
  .update(canonicalQuery, "utf8")
  .digest("hex");

// 4) Build final request URL: canonical query + signature
const finalUrl = new URL(endpoint);
finalUrl.search = `${canonicalQuery}&signature=${signature}`;

const response = await fetch(finalUrl);
if (!response.ok) {
  throw new Error(`Request failed: ${response.status} ${response.statusText}`);
}

const bytes = Buffer.from(await response.arrayBuffer());
await writeFile("screenshot.png", bytes);

from urllib.parse import urlencode, urlsplit, urlunsplit
from urllib.request import urlopen
import hmac
import hashlib

access_key = "YOUR_ACCESS_KEY"
secret_key = "YOUR_SECRET_KEY"  # keep this secret
target_url = "https://example.com/"

base = urlsplit("https://api.screenshotscout.com/v1/capture")

# 1) Parameters you will send (list of pairs to preserve order / allow duplicates)
params = [
    ("access_key", access_key),
    ("url", target_url),
]

# 2) Build canonical query string (sorted by key, without `signature`)
def build_canonical_query(pairs):
    filtered = [(k, v) for (k, v) in pairs if k != "signature"]
    # Python's sort is stable, so duplicates keep original order
    filtered.sort(key=lambda item: item[0])
    return urlencode(filtered, doseq=True)

canonical_query = build_canonical_query(params)

# 3) Compute HMAC-SHA256(secret_key, canonical_query) as lowercase hex
signature = hmac.new(
    secret_key.encode("utf-8"),
    canonical_query.encode("utf-8"),
    hashlib.sha256,
).hexdigest()

# 4) Build final query string and request URL
query = f"{canonical_query}&signature={signature}"
endpoint = urlunsplit((base.scheme, base.netloc, base.path, query, base.fragment))

with urlopen(endpoint) as response:
    image_bytes = response.read()

with open("screenshot.png", "wb") as f:
    f.write(image_bytes)

<?php

$accessKey = 'YOUR_ACCESS_KEY';
$secretKey = 'YOUR_SECRET_KEY'; // keep this secret
$targetUrl = 'https://example.com/';

$endpoint = 'https://api.screenshotscout.com/v1/capture';

// 1) Parameters you will send
$params = [
    'access_key' => $accessKey,
    'url'        => $targetUrl,
    // add more options here as needed
];

// 2) Build canonical query string (sorted by key, without `signature`)
unset($params['signature']); // just in case
ksort($params); // sort by parameter name (keys)

$canonicalQuery = http_build_query(
    $params,
    '',
    '&',
    PHP_QUERY_RFC1738 // spaces encoded as "+" like URLSearchParams
);

// 3) Compute HMAC-SHA256(secretKey, canonicalQuery) as lowercase hex
$signature = hash_hmac('sha256', $canonicalQuery, $secretKey);

// 4) Final request URL: canonical query + signature
$requestUrl = sprintf('%s?%s&signature=%s', $endpoint, $canonicalQuery, $signature);

$ch = curl_init($requestUrl);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

$bytes = curl_exec($ch);
curl_close($ch);

file_put_contents('screenshot.png', $bytes);