Web Profiles

Headers, cookies and user agent

The last block of the profile, and the one that unlocks pages a signed-out browser cannot reach: staging sites, member areas, dashboards, anything behind a login.

The fields

Headers and Cookies are under Fine-tuning › Headers & cookies. User agent is under How the browser introduces itself.

Field	Type	Default	Description
`User agent`	Text	—	Replaces the browser's own user agent string. Leave empty to keep it.
`Headers`	One per line	—	Written as key: value. Sent only with requests to the site being captured and its subdomains, never to the other sites the page loads from.
`Cookies`	One per line	—	Written as key=value. Set for the origin of the page being captured.

Note the two use different separators — a colon for headers, an equals sign for cookies.

Headers — one per line, key:value

Authorization: Bearer eyJhbGciOi...
X-Api-Key: your-internal-key
Accept-Language: en-GB

Cookies — one per line, key=value

session_id=8f14e45fceea467a
consent=accepted
preview_mode=1

Not on the free trial

Headers and cookies are included in every paid plan. They are not available on the free trial.

Capturing behind a login

The product does not fill in a login form. Instead you give it the proof of a session that a signed-in browser already holds, and it starts the capture already authenticated. Two ways in:

A session cookie. Sign in normally in your own browser, open developer tools, find the cookie the site uses for the session, and copy its name and value into Cookies.
An authorization header. Where the site accepts a token or an API key, put it in Headers instead. This tends to last longer than a session cookie.

Sessions expire, and the capture will not tell you why

When a session cookie lapses, the page starts returning the login screen and the schedule keeps dutifully capturing it. Check the capture’s HTTP status and its thumbnail after any change, and prefer a long-lived token where the site offers one.

Also worth trying: a consent cookie

Cookies are not only for logins. If you know the cookie a site sets when a visitor accepts its banner, setting it here means the banner never renders — cleaner than clicking it away with a selector on every schedule.

User agent

Most profiles should leave this empty. The browser’s own string is honest, and an emulated device already supplies the right one for that phone.

Set it when:

Your own site treats a named agent differently and you want to capture that path.
A service expects an identifiable agent and you would rather be recognisable than anonymous.
You are reproducing a bug a specific browser version produces.

Keeping this safe

Use a dedicated account. Create a read-only user for capturing rather than lending the profile your own credentials.
Give it the narrowest access that works. The capture only needs to read the page.
Keep those profiles separate. A profile with a session cookie in it should not also be the shared profile forty public pages use.
Remember the capture is the page. Anything a signed-in visitor can see ends up in the image, and then in whatever storage you deliver to.

Did this page answer your question?

Tell us what is missing