Some things that were harder than expected building this:

- Playwright uses about half the RAM of Puppeteer for the same browser pool, which matters on a small VPS

- Playwright only outputs PNG and JPEG natively — getting WebP required piping through Sharp

- SSRF protection is non-trivial. Private IPs, localhost, link-local ranges, and cloud metadata endpoints (169.254.169.254) all need to be blocked. DNS rebinding is a separate problem

- Cache keys need to be fully deterministic — a hash of the entire request params (URL + viewport + format + scale + CSS), not just the URL

The API is one endpoint:

  curl -X POST https://api.pixshot.dev/v1/screenshot \
    -H "Content-Type: application/json" \
    -H "x-api-key: YOUR_KEY" \
    -d '{"url": "https://example.com", "format": "webp"}'

It also generates OG images (1200x630) from structured data. Source isn't open yet but happy to go into detail on any of this.