# Authentication

Source: https://zshot-cli.com/reference/server/authentication/
Markdown: https://zshot-cli.com/reference/server/authentication/index.md
Section: [Reference](https://zshot-cli.com/reference/) › [Server](https://zshot-cli.com/reference/server/)

The server authorizes a request by a credential header or by a signed URL.

| Method | Flag | Client sends |
| --- | --- | --- |
| Basic | [`--server-basic-auth`](/reference/flags/server/server-basic-auth) | `Authorization: Basic <base64 of user:password>` |
| Token | [`--server-token-auth`](/reference/flags/server/server-token-auth) | `Authorization: Bearer <token>` |
| Signed URL | [`--server-signed-url`](/reference/flags/server/server-signed-url) | `expires` and `signature` query parameters |

A missing or wrong credential answers `401`. With both Basic and token set, only the token authorizes.

## Precedence

A valid credential header authorizes outright, and a wrong one is rejected without checking a signature. A request with no credential header is checked for a signature when signed URLs are on.

Signatures apply to `GET /`, `DELETE /` and `GET /assets`. `POST /` and `/mcp` authorize by credential header only, so a server with signed URLs and no Basic or token auth accepts any POST and any MCP request.

## Signed URLs

Sign the request's query parameters, `expires` included:

1. Set `expires` to a Unix time in seconds.
2. Sort the parameters by key, then by value, and form-encode them.
3. Compute HMAC-SHA256 of that string with the secret, as lowercase hex.
4. Append it as `signature`.

```python
import hashlib, hmac, time, urllib.parse

params = {
    "url": "https://zshot-cli.com/example_assets/zrm/",
    "output_type": "png",
    "expires": str(int(time.time()) + 300),
}
query = urllib.parse.urlencode(sorted(params.items()))
signature = hmac.new(b"SECRET", query.encode(), hashlib.sha256).hexdigest()
print("http://127.0.0.1:3000/?" + query + "&signature=" + signature)
```

| Response | Reason |
| --- | --- |
| `401` | no `signature` |
| `403` | the signature does not match, `expires` is missing or past, or `expires` is beyond [`--server-signed-url-max-age`](/reference/flags/server/server-signed-url-max-age) |

The server signs the asset links in a render response with the same secret; see [Additional Assets](/reference/server/additional-assets).

## Metrics Endpoint

[`--server-prometheus-auth`](/reference/flags/server/server-prometheus-auth) sets a Basic credential that is the only one `/metrics` accepts. Without it, `/metrics` takes the main server's credentials, and is open when the server has none.

## Related

Flags:

- [`--server-basic-auth`](https://zshot-cli.com/reference/flags/server/server-basic-auth/)
- [`--server-token-auth`](https://zshot-cli.com/reference/flags/server/server-token-auth/)
- [`--server-signed-url`](https://zshot-cli.com/reference/flags/server/server-signed-url/)
- [`--server-signed-url-max-age`](https://zshot-cli.com/reference/flags/server/server-signed-url-max-age/)
- [`--server-prometheus-auth`](https://zshot-cli.com/reference/flags/server/server-prometheus-auth/)

Topics:

- [Browser as a CDN](https://zshot-cli.com/examples/browser-as-a-cdn/)
- [Metrics](https://zshot-cli.com/reference/server/metrics/)
- [HMAC](https://datatracker.ietf.org/doc/html/rfc2104) — RFC 2104

## Navigation

- [Examples](https://zshot-cli.com/examples/)
- [Download](https://zshot-cli.com/download/)
- [Purchase](https://zshot-cli.com/purchase/)
- [Reference](https://zshot-cli.com/reference/)
  - [Formats](https://zshot-cli.com/reference/formats/)
  - [Flags](https://zshot-cli.com/reference/flags/)
  - [Agents](https://zshot-cli.com/reference/agents/)
  - [Configuration](https://zshot-cli.com/reference/configuration/)
  - [Crawling](https://zshot-cli.com/reference/crawling/)
  - [Docker](https://zshot-cli.com/reference/docker/)
  - [Exit Codes](https://zshot-cli.com/reference/exit_codes/)
  - [Linux](https://zshot-cli.com/reference/linux/)
  - [LLM Connections](https://zshot-cli.com/reference/llm_connections/)
  - [LLM Formatting](https://zshot-cli.com/reference/llm_formatting/)
  - [Local Inputs](https://zshot-cli.com/reference/inputs/)
  - [Navigator](https://zshot-cli.com/reference/navigator/)
  - [Security](https://zshot-cli.com/reference/security/)
  - [Server](https://zshot-cli.com/reference/server/)
    - [API](https://zshot-cli.com/reference/server/api/)
    - [Endpoints](https://zshot-cli.com/reference/server/endpoints/)
    - [Metrics](https://zshot-cli.com/reference/server/metrics/)
    - [Additional Assets](https://zshot-cli.com/reference/server/additional-assets/)
    - **Authentication**
    - [Caching](https://zshot-cli.com/reference/server/caching/)
  - [Shell completions](https://zshot-cli.com/reference/shell_completions/)
  - [Storage](https://zshot-cli.com/reference/storage/)
  - [Timeouts](https://zshot-cli.com/reference/timeouts/)
  - [Web Bot Auth](https://zshot-cli.com/reference/web_bot_auth/)
- [Support](https://zshot-cli.com/support/)
- [Changelog](https://zshot-cli.com/changelog/)

Site index: https://zshot-cli.com/llms.txt