Shotpipe is a hosted screenshot and Open Graph image API for developers.
Everything is a signed GET request: two endpoints, one HMAC signing scheme,
no SDK required and no dashboard to log into. You sign a URL with your key's
secret, request it, and get image bytes back.
GET /render captures any public URL in headless Chrome and returns PNG, JPEG,
or PDF. Parameters cover viewport width and height, device pixel ratio (up to
3x for retina), full-page capture, clipping to a CSS selector, waiting for a
selector before capture, a fixed delay for late-hydrating JS, dark-mode
emulation, and transparent backgrounds. Ad and tracker blocking plus
cookie-consent-banner suppression are on by default, so screenshots show the
page instead of a consent wall — both can be turned off for an as-served
capture.
GET /og renders Open Graph images from hosted HTML/CSS templates,
parameterized by query string. Signatures don't expire, so static-site
generators sign the URL locally at build time in microseconds and the image
renders lazily on the first social-crawler hit — builds never wait on Chrome.
Official integrations: eleventy-plugin-shotpipe, astro-shotpipe, a Hugo
snippet, and shotpipe-mcp for MCP clients.
SSRF protection is the main difference for apps that render user-submitted
URLs. Shotpipe resolves DNS itself, checks every returned address against
private, loopback, link-local, and cloud metadata ranges, pins the resolved IP
for the connection to defeat DNS rebinding, and repeats the check on every
redirect hop — at request time and again inside the render workers. Non-HTTP(S)
schemes and URLs with embedded credentials are rejected.
Renders are cached at the edge: the first request for a given set of
parameters renders, and identical requests after that are served from the CDN
in milliseconds. Target URLs are normalized before caching — fragments
dropped, tracking parameters stripped, remaining params sorted, host
lowercased — so URLs that differ only by utm junk share a single cache entry.
Other endpoints: GET /check returns a JSON health verdict for a URL
(alive / parked / not_found / server_error / unreachable) for directory and
listing sites; GET /meta returns favicon, logo, title, description, and
og:image for building card listings; POST /logo stores a logo for reuse in OG
templates; GET /usage reports the current month's render count.
An account is an API key delivered by email. Free tier is 100 renders/month
with no card. Paid: Pro $14/mo (2,000 renders), Studio $39/mo (10,000),
Agency $99/mo (30,000). Every feature is on every plan — tiers differ only by
volume and rate limit.