URL Signing

Signing a url is the most secure way to prevent misuse of your API Key. It requires computation on the backend of your website.

Activation of signatures

  1. in the user menu, select the API keys tab
  2. for the key you want to activate the function for, go to settings
  3. in the menu, select the Security tab
  4. activate Signed URL and save the settings
  5. note down the signing key (for example: abcd1234)

Now you must sign every image displayed through this API key. Unsigned use of the key will return an error image.

How to create a signed URL?

  1. your original URL looks something like this:

    https://abcdef.imagedit.io/v1/https://web.cz/image.png?w=100&grayscale=on

  2. combine your signing key with your URL and make a sha1 hash out of the value:

    sha1(abcd1234https://web.cz/image.png?w=100&grayscale=on)

    (result: abcdefghijklmnopqrstuvwxyz)

  3. attach the resulting hash to your request:

    https://abcdef.imagedit.io/v1/https://web.cz/image.png?w=100&grayscale=on&sign=abcdefghijklmnopqrstuvwxyz