Imagelato for developers

Resize and reformat images from your backend, or review image projects and delivery health through our OAuth-protected MCP connector.

API keys

Get an API key

Create an API key in your Imagelato dashboard. The plaintext secret is shown once, when the key is created, and is never returned again — store it somewhere your backend can read it.

A key is pinned to a single project, so it can only ever touch that project images, batches and templates. Authenticate with HTTP Basic auth, sending the base64-encoded secret in the Authorization header.

curl https://api.imagelato.com/api/templates \
  -H "Authorization: Basic $(printf %s YOUR_API_KEY_SECRET | base64)"

Requests authenticated with a key are rate limited per key, 300 requests per minute by default. Over the limit the API answers 429.

Quick start

Process your first image

POST a data URI to /api/images with the sizes and formats you want. Imagelato stores the original, generates every variant and answers with a batch of CDN URLs. Pass a template name instead of sizes and formats to reuse a preset you configured in the dashboard.

curl https://api.imagelato.com/api/images \
  -H "Authorization: Basic $(printf %s YOUR_API_KEY_SECRET | base64)" \
  -H "Content-Type: application/json" \
  -d '{
    "file": "data:image/png;base64,iVBORw0KGgo...",
    "slug": "hero-banner",
    "formats": ["webp", "avif", "jpeg"],
    "sizes": [320, 640, 1280]
  }'

The response is a batch. Fetch it again later with GET /api/batches/{batchId}, or list every batch of the project with GET /api/batches.

Browse the full API reference — every endpoint with its parameters, request body, responses and required scope.

CLI

Command-line interface

The same projects, processed batches and resize/reformat templates are available from your terminal through the imagelato CLI. Install it globally with npm, or run it ad hoc with npx.

Authentication is one command: imagelato login opens your browser to sign in to your Imagelato account and stores a session for later commands — no API key to paste.

# Install once, globally
npm install -g imagelato
# or run it ad hoc without installing
npx imagelato --help

# Log in — opens your browser to sign in and stores a session
imagelato login

# List the projects of your organization
imagelato projects list

# Recent processed batches of a project
imagelato batches list --projectId PROJECT_ID

# Inspect one batch: variants, formats, sizes, CDN URLs
imagelato batches read BATCH_ID

# Create a resize/reformat template
imagelato templates add thumbnails --projectId PROJECT_ID --formats jpg,webp --sizes 512,256,128,64

The CLI is open source at github.com/imagelato/cli and published as imagelato on npm. Run any command with --help to see its options.

Claude connector

Use Imagelato from Claude

Connect Imagelato to Claude to review the projects, templates and processed image batches in your organization. The connector uses your Imagelato account, and the Imagelato API applies the same organization boundary as the dashboard.

In Claude, open Settings, choose Connectors, then add a custom connector with the URL below. Claude sends you to Imagelato to sign in and approve access.

# In Claude: Settings > Connectors > Add custom connector

https://mcp.imagelato.com/mcp

# Then sign in to Imagelato and approve the requested scopes.
# Example: "Show an overview of my first image project."

The connector has separate, narrow read and write tools. Every create, update or delete operation asks for confirmation. It can render a bounded project overview and a processed-batch detail card in compatible MCP hosts.

  • list_projects · get_project · show_project_overviewPage through projects, inspect one, or render one with at most eight recent processed batches.
  • list_batches · get_batchReview bounded batch metadata and at most 20 first-party resized or reformatted variants.
  • list_templates · get_templateReview deterministic resize and reformat presets by project.
  • list_webhook_subscriptionsAudit subscribed events and delivery health; only endpoint origins are shown.
  • list_team_membersReview display names and roles without email addresses, phone numbers or user ids.
  • add_project · add_template · update_templateCreate a project or preset, or replace selected preset fields after confirmation.
  • delete_batchPermanently delete one exact batch and its files after confirmation.

The public connector cannot upload or process media, list the shared object bucket, or generate images with AI. Imagelato presets only configure deterministic resizing and reformatting performed by the product API outside the connector.

Processed images may contain private customer material. Model-visible results exclude organization internals, credentials, webhook secrets, contact details and third-party asset URLs. Only connect accounts and conversations authorized to handle the remaining project and asset metadata, and disconnect the connector when access is no longer needed.

ChatGPT and MCP clients

Use Imagelato from any remote MCP client

Imagelato speaks the Model Context Protocol over streamable HTTP. In ChatGPT Developer Mode, add the production URL as a custom connector. Other clients use the same URL; there is no API key to paste because the client opens the Imagelato OAuth sign-in flow.

# ChatGPT Developer Mode and every remote-MCP client use:
https://mcp.imagelato.com/mcp

# Codex CLI
codex mcp add imagelato --url https://mcp.imagelato.com/mcp
codex mcp login imagelato

# VS Code
code --add-mcp '{"name":"imagelato","type":"http","url":"https://mcp.imagelato.com/mcp"}'

# Cursor, Windsurf and other editors
{
  "mcpServers": {
    "imagelato": {
      "type": "http",
      "url": "https://mcp.imagelato.com/mcp"
    }
  }
}

# Clients limited to local stdio servers can bridge:
npx mcp-remote https://mcp.imagelato.com/mcp

Authentication uses OAuth 2.0 with dynamic client registration and PKCE. The available scopes are imagelato:read and imagelato:write; your signed-in account and live organization roles remain the final authorization boundary. Remove or revoke the connector to end access.

List calls return 25 records by default, accept at most 100, and provide an opaque cursor when more data exists. Batch detail returns at most 20 variants and project overview at most eight recent batches.

Agent Skills

Teach your coding agent Imagelato

Imagelato ships Agent Skills — guides following the agentskills.io standard that teach coding agents how to work with image projects, templates and processed batches through the imagelato CLI and the MCP connector, instead of guessing at commands and tools.

# Install the Imagelato skills into your coding agent
npx skills add imagelato/skills

One command installs the skills into Claude Code, Cursor, Codex, Gemini CLI and any other agent that follows the Skills standard. The CLI also bundles the same guides, version-matched to the commands it ships: imagelato skills get <name> prints one on demand.

The skills are open source at github.com/imagelato/skills. Claude users can also install the Imagelato Claude plugin, which bundles the connector together with the skills: github.com/imagelato/claude-plugin.

Scopes

Scopes

Every key carries a list of scopes and a request is refused with 403 unless the key holds the scope its endpoint requires. New keys are read-only by default, so a key can never process images until you widen it deliberately.

  • images:readList the image objects already stored for the project.
  • images:writeProcess an image: upload it and generate the requested sizes and formats.
  • batches:readList processed batches and read a single batch with its variants.
  • batches:writeDelete a batch and the files it generated.
  • projects:readRead the project the key is pinned to.
  • projects:writeCreate a project.
  • templates:readList templates and read one by id or name.
  • templates:writeCreate and update templates.

Webhooks

Webhooks

Subscribe an https endpoint and Imagelato POSTs events to it as they happen. Subscriptions are scoped to a project, and an empty event list subscribes to everything.

  • batch.createdAn image finished processing and its variants are ready.
  • batch.deletedA batch and its files were deleted.
  • project.createdA new project was created.
  • template.createdA new template was created.
  • template.updatedAn existing template was changed.

Verifying a delivery

Every request carries an X-Imagelato-Signature header of the form t=timestamp,v1=signature. The signature is an HMAC-SHA256 of timestamp.body keyed by your subscription secret; recompute it and compare before trusting the payload. The event name is repeated in the X-Imagelato-Event header.

POST https://your-server.com/imagelato-webhook
X-Imagelato-Event: batch.created
X-Imagelato-Signature: t=1719000000,v1=<hmac-sha256 hex>
Content-Type: application/json

{
  "event": "batch.created",
  "timestamp": 1719000000,
  "data": { "...": "..." }
}

Deliveries time out after 5 seconds and are attempted once, with no retries. An endpoint that fails 20 times in a row is deactivated automatically, so a dead receiver cannot slow down image processing forever.

Start building