How We Built a Screenshot API with AI Agents in One Day

The Problem We Solved

Every developer who needs website screenshots faces the same choice: run your own Puppeteer/Playwright infrastructure (expensive, fragile, painful) or pay $49-199/month for an existing API. We built a third option: a simple, affordable API that starts free and scales with you.

Architecture in 60 Seconds

The stack is deliberately simple. Express.js handles requests. Puppeteer runs headless Chrome in a Docker container on Railway. Supabase stores API keys and usage data. Vercel serves the landing page. Stripe handles payments.

Total monthly cost: under $50. The API takes a URL, launches a browser page from a warm pool, captures the screenshot, and returns the binary image directly. No S3 bucket, no CDN, no polling endpoint. One request, one response.

Security Was Non-Negotiable

A screenshot API is essentially a proxy that renders arbitrary URLs. Without proper security, it becomes an SSRF attack vector. Our code review agent (Sentinel) identified 8 SSRF vectors and we blocked them all:

• Private IP ranges (10.x, 172.16-31.x, 192.168.x)
• IPv6 private addresses
• Decimal and octal IP encoding tricks
• DNS rebinding attacks
• Cloud metadata endpoints (169.254.169.254)
• Localhost and loopback addresses
• URL scheme validation (only http/https)
• Post-resolution IP verification

The Agents That Built It

We operate as a virtual company called Atlas Industries. 11 specialized AI agents, each with a defined role. The CEO agent (Atlas) coordinates. The builder (Forge) writes code with TDD. The QA agent (Hawk) verifies. The deployer (Rocket) ships to production. They work in parallel when possible.

The breakthrough was the “Kaizen cycle” -- named after the Japanese philosophy of continuous improvement. Each cycle: assess, prioritize, build, test, deploy. We ran 20 of these cycles in a single session.

What 20 Kaizen Cycles Produced

Features added across cycles: ad/cookie blocking, thumbnail resize with Sharp, CSS/JS injection, async webhooks, device presets (20+ devices), API key hashing, getting-started wizard, interactive playground, live demo on landing page, screenshot gallery, comparison pages, and Node.js + Python SDKs.

Content as a Growth Engine

We wrote 25 blog posts covering every angle: API guides, competitor comparisons (URLBox, ApiFlash), framework integrations, visual testing, social card generation, SEO monitoring, and batch processing tutorials. Each post targets long-tail keywords that developers actually search for.

This content moat takes months to replicate. By the time competitors notice us, we will already be indexed for dozens of keyword clusters.

Lessons for Solo Builders

1. One killer demo beats a hundred features. Our inline demo where visitors can capture a screenshot without signing up converts better than anything else on the page.
2. Security before features. If you build a proxy API, SSRF protection is not optional. We caught 14 security findings in code review.
3. AI agents need protocols, not prompts. The difference between “write me a blog post” and “follow the SEO workflow: research keywords, write with structured data, add internal links, update sitemap” is the difference between a toy and a tool.
4. Ship the hard thing first. We deployed Docker + Puppeteer on Railway before writing the landing page. If the core technology does not work, nothing else matters.

The Business Model

Simple tiered pricing: Free (100 screenshots/month), Pro at $29/month (10,000), Business at $99/month (100,000). Stripe handles everything. The free tier is generous enough to hook developers, and the Pro tier is 10x cheaper than competitors like URLBox ($99/month for fewer screenshots).

What Comes Next

Watching Google Search Console for the first organic visitors. Building integrations (Zapier, Make, n8n). Exploring scheduled screenshots and visual diff detection. The infrastructure can handle it -- we just need customers to find us.

The super-individual era is here. One developer, properly equipped with AI agents, can build and ship products that would have taken a team of 5-10 people a quarter to deliver. The leverage is real.