ShotPipe

Shotpipe is a hosted screenshot and Open Graph image API for developers. Everything is a signed GET request: two endpoints, one HMAC signing scheme, no SDK required and no dashboard to log into. You sign a URL with your key's secret, request it, and get image bytes back.

GET /render captures any public URL in headless Chrome and returns PNG, JPEG, or PDF. Parameters cover viewport width and height, device pixel ratio (up to 3x for retina), full-page capture, clipping to a CSS selector, waiting for a selector before capture, a fixed delay for late-hydrating JS, dark-mode emulation, and transparent backgrounds. Ad and tracker blocking plus cookie-consent-banner suppression are on by default, so screenshots show the page instead of a consent wall — both can be turned off for an as-served capture.

GET /og renders Open Graph images from hosted HTML/CSS templates, parameterized by query string. Signatures don't expire, so static-site generators sign the URL locally at build time in microseconds and the image renders lazily on the first social-crawler hit — builds never wait on Chrome. Official integrations: eleventy-plugin-shotpipe, astro-shotpipe, a Hugo snippet, and shotpipe-mcp for MCP clients.

SSRF protection is the main difference for apps that render user-submitted URLs. Shotpipe resolves DNS itself, checks every returned address against private, loopback, link-local, and cloud metadata ranges, pins the resolved IP for the connection to defeat DNS rebinding, and repeats the check on every redirect hop — at request time and again inside the render workers. Non-HTTP(S) schemes and URLs with embedded credentials are rejected.

Renders are cached at the edge: the first request for a given set of parameters renders, and identical requests after that are served from the CDN in milliseconds. Target URLs are normalized before caching — fragments dropped, tracking parameters stripped, remaining params sorted, host lowercased — so URLs that differ only by utm junk share a single cache entry.

Other endpoints: GET /check returns a JSON health verdict for a URL (alive / parked / not_found / server_error / unreachable) for directory and listing sites; GET /meta returns favicon, logo, title, description, and og:image for building card listings; POST /logo stores a logo for reuse in OG templates; GET /usage reports the current month's render count.

An account is an API key delivered by email. Free tier is 100 renders/month with no card. Paid: Pro $14/mo (2,000 renders), Studio $39/mo (10,000), Agency $99/mo (30,000). Every feature is on every plan — tiers differ only by volume and rate limit.