feat(api): add SCREENSHOT_API_SECRET to environment and use it in screenshot requests

.env.example

@@ -94,3 +94,6 @@ REVALIDATE_SECRET_TOKEN=your-secure-random-token
 
 # To run clear-trash cron in vercel
 CRON_SECRET=your-secure-random-token
+
+# Screenshot API Secret
+SCREENSHOT_API_SECRET=your-screenshot-api-secret

src/app/api/v2/bookmark/add-url-screenshot/route.ts

@@ -1,5 +1,6 @@
 import { after } from "next/server";
 
+import { env } from "@/env/server";
 import { logger } from "@/lib/api-helpers/axiom";
 import { createAxiomRouteHandler, withAuth } from "@/lib/api-helpers/create-handler-v2";
 import { RecollectApiError } from "@/lib/api-helpers/errors";
@@ -70,6 +71,7 @@ export const POST = createAxiomRouteHandler(
       // 1. Capture screenshot from external API
       const [screenshotError, screenshotResponse] = await vet(async () => {
         const r = await fetch(`${SCREENSHOT_API}/try?url=${encodeURIComponent(data.url)}`, {
+          headers: { Authorization: `Bearer ${env.SCREENSHOT_API_SECRET}` },
           signal: AbortSignal.timeout(SCREENSHOT_TIMEOUT_MS),
         });
         if (!r.ok) {

src/app/api/v2/screenshot/route.ts

@@ -109,7 +109,9 @@ export const POST = createAxiomRouteHandler(
         } else {
           // Regular screenshot via screenshot service
           try {
-            const response = await fetch(`${SCREENSHOT_API}/try?url=${encodeURIComponent(url)}`);
+            const response = await fetch(`${SCREENSHOT_API}/try?url=${encodeURIComponent(url)}`, {
+              headers: { Authorization: `Bearer ${env.SCREENSHOT_API_SECRET}` },
+            });
             if (!response.ok) {
               throw new Error(`Screenshot API returned ${String(response.status)}`);
             }

src/env/server.ts

@@ -15,6 +15,7 @@ export const env = createEnv({
     PDF_URL_SCREENSHOT_API: z.string(),
     RESEND_KEY: z.string().optional(),
     REVALIDATE_SECRET_TOKEN: z.string(),
+    SCREENSHOT_API_SECRET: z.string(),
     SUPABASE_SERVICE_KEY: z.string(),
     UMAMI_ID: z.string().optional(),
     UMAMI_SRC: z.string().optional(),

src/pages/api/bookmark/add-url-screenshot.ts

@@ -11,6 +11,7 @@ import type {
 import type { PostgrestError } from "@supabase/supabase-js";
 import type { VerifyErrors } from "jsonwebtoken";
 
+import { env } from "@/env/server";
 import { upload } from "@/lib/storage/media-upload";
 import { collectAdditionalImages, collectVideo } from "@/utils/helpers";
 import { vet } from "@/utils/try";
@@ -63,6 +64,7 @@ export default async function handler(
 
     const [screenshotError, screenShotResponse] = await vet(() =>
       axios.get(`${SCREENSHOT_API}/try?url=${encodeURIComponent(request.body.url)}`, {
+        headers: { Authorization: `Bearer ${env.SCREENSHOT_API_SECRET}` },
         responseType: "json",
       }),
     );

src/pages/api/v1/screenshot.ts

@@ -93,7 +93,10 @@ export default async function handler(request: NextApiRequest, response: NextApi
       try {
         const { data: screenshotData } = await axios.get(
           `${SCREENSHOT_API}/try?url=${encodeURIComponent(url)}`,
-          { responseType: "json" },
+          {
+            headers: { Authorization: `Bearer ${env.SCREENSHOT_API_SECRET}` },
+            responseType: "json",
+          },
         );
 
         const base64data = Buffer.from(screenshotData?.screenshot?.data, "binary").toString(

turbo.json

@@ -20,7 +20,8 @@
         "PDF_URL_SCREENSHOT_API",
         "GOOGLE_GEMINI_TOKEN",
         "RESEND_KEY",
-        "REVALIDATE_SECRET_TOKEN"
+        "REVALIDATE_SECRET_TOKEN",
+        "SCREENSHOT_API_SECRET"
       ],
       "inputs": ["$TURBO_DEFAULT$", ".env", ".env.local"],
       "outputs": [".next/**", "!.next/cache/**"]