Authenticated pages

Use POST for anything carrying a credential — a query string ends up in proxy logs, browser history and referrer headers.

{
  "url": "https://app.example.com/dashboard",
  "cookies": ["session=abc123; Domain=.example.com; Path=/; Secure"],
  "headers": ["X-Tenant: acme"],
  "authorization": "Bearer eyJhbGciOi...",
  "format": "png"
}

Without an explicit Domain, a cookie is anchored to the URL you are capturing — which is what session=abc on its own is asking for.

What happens to those values

They are separated from the rest of the request before anything is stored, encrypted with AES-256-GCM under a managed key, decrypted only inside the worker, and destroyed when the job ends. They never appear in the request log, in the normalized options shown in the dashboard, or in an error message.

The cache key includes a hash of them, so two captures with different sessions never share a cached result — without the values themselves living in a cache key.