Imagelato for developers

Resize and reformat images from your own backend: a REST API with scoped keys, reusable templates and signed webhooks.

API keys

Get an API key

Create an API key in your Imagelato dashboard. The plaintext secret is shown once, when the key is created, and is never returned again — store it somewhere your backend can read it.

A key is pinned to a single project, so it can only ever touch that project images, batches and templates. Authenticate with HTTP Basic auth, sending the base64-encoded secret in the Authorization header.

curl https://api.imagelato.com/api/templates \
  -H "Authorization: Basic $(printf %s YOUR_API_KEY_SECRET | base64)"

Requests authenticated with a key are rate limited per key, 300 requests per minute by default. Over the limit the API answers 429.

Quick start

Process your first image

POST a data URI to /api/images with the sizes and formats you want. Imagelato stores the original, generates every variant and answers with a batch of CDN URLs. Pass a template name instead of sizes and formats to reuse a preset you configured in the dashboard.

curl https://api.imagelato.com/api/images \
  -H "Authorization: Basic $(printf %s YOUR_API_KEY_SECRET | base64)" \
  -H "Content-Type: application/json" \
  -d '{
    "file": "data:image/png;base64,iVBORw0KGgo...",
    "slug": "hero-banner",
    "formats": ["webp", "avif", "jpeg"],
    "sizes": [320, 640, 1280]
  }'

The response is a batch. Fetch it again later with GET /api/batches/{batchId}, or list every batch of the project with GET /api/batches.

Browse the full API reference — every endpoint with its parameters, request body, responses and required scope.

Scopes

Scopes

Every key carries a list of scopes and a request is refused with 403 unless the key holds the scope its endpoint requires. New keys are read-only by default, so a key can never process images until you widen it deliberately.

  • images:readList the image objects already stored for the project.
  • images:writeProcess an image: upload it and generate the requested sizes and formats.
  • batches:readList processed batches and read a single batch with its variants.
  • batches:writeDelete a batch and the files it generated.
  • projects:readRead the project the key is pinned to.
  • projects:writeCreate a project.
  • templates:readList templates and read one by id or name.
  • templates:writeCreate and update templates.

Webhooks

Webhooks

Subscribe an https endpoint and Imagelato POSTs events to it as they happen. Subscriptions are scoped to a project, and an empty event list subscribes to everything.

  • batch.createdAn image finished processing and its variants are ready.
  • batch.deletedA batch and its files were deleted.
  • project.createdA new project was created.
  • template.createdA new template was created.
  • template.updatedAn existing template was changed.

Verifying a delivery

Every request carries an X-Imagelato-Signature header of the form t=timestamp,v1=signature. The signature is an HMAC-SHA256 of timestamp.body keyed by your subscription secret; recompute it and compare before trusting the payload. The event name is repeated in the X-Imagelato-Event header.

POST https://your-server.com/imagelato-webhook
X-Imagelato-Event: batch.created
X-Imagelato-Signature: t=1719000000,v1=<hmac-sha256 hex>
Content-Type: application/json

{
  "event": "batch.created",
  "timestamp": 1719000000,
  "data": { "...": "..." }
}

Deliveries time out after 5 seconds and are attempted once, with no retries. An endpoint that fails 20 times in a row is deactivated automatically, so a dead receiver cannot slow down image processing forever.

Start building