Authenticated Transform

Self-hosted only. Signed delivery URLs are not available on Cloud yet. Same transformations as the public /t/ endpoint, behind an HMAC-SHA256 signature. Use it for private media, or to restrict which transformations can be applied.

GET /authenticated/s--{signature}/{transformations}/{path}

GET /authenticated/s--a1b2c3d4e5f6a7b8/w_400,h_400,c_fill/private/photo.jpg

Auth: Signature verification (no API key needed at request time)

Path parameters

Param	Type	Description
`signature`	`string`	Required. 16 hex characters, truncated from the full HMAC-SHA256 digest
`transformations`	`string`	Comma-separated parameters, identical to the public `/t/` endpoint
`path`	`string`	Required. Path to the file, identical to the public `/t/` endpoint

The signature is computed server-side over the transformations plus the file path, using API_SECRET as the HMAC key. Both must match what was signed, since any change to the URL invalidates the signature. A signature of any other length is rejected with 400 before the value is even checked. See Signed URLs for code examples on generating signatures.

Response

Same as the public transform endpoint, returns binary file content.

Code	Meaning
`200`	Transformed file returned
`400`	Invalid URL format, wrong signature length, or transformation parameters on a non-transformable type
`401`	Signature does not match, tampered or wrong secret
`404`	File not found

Signed URLs guide

How to generate signed URLs from your backend.

Public Transform

Unrestricted on-the-fly transformations.

Overview

Media

Files

Storage

Cache

Video Processing

API Keys

System

Path parameters

Response

Signed URLs guide

Public Transform

​Path parameters

​Response

​Related

Signed URLs guide

Public Transform

Path parameters

Response

Related