> ## Documentation Index
> Fetch the complete documentation index at: https://codebyahmed.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.
# ImageKit Upload Auth — Get Signed Upload Credentials
> Get signed ImageKit authentication parameters for direct browser uploads. Use the returned token, signature, and endpoint to upload images for reviews.
The ImageKit Upload Auth endpoint provides short-lived, signed credentials that allow your browser or mobile app to upload images **directly to ImageKit** — without routing file data through your own server. Fetch these credentials just before each upload, pass them to the ImageKit JS SDK, and then use the resulting ImageKit URL when creating or updating a review.
The URLs that ImageKit returns after a successful upload are the values you should pass as `image_url` in the `images` array when calling `POST /reviews` or `PATCH /reviews/{review_public_id}`. The server validates that image URLs originate from the allowed ImageKit endpoint before saving them.
***
## Get Upload Credentials
Retrieve a signed token, signature, and configuration needed to perform a direct browser upload via the ImageKit JS SDK.
```
GET /uploads/imagekit-auth
```
**Authentication:** Requires an active session cookie. Unauthenticated requests return `401 Unauthorized`.
**Query parameters**
Controls which ImageKit folder the uploaded file is placed in. Accepted values:
* `reviews` (default) — uploads go to `/ecommerce/reviews/`
* `products` — uploads go to the product images folder
Unknown values fall back silently to `reviews`.
**Response fields**
Signed ImageKit authentication parameters. Pass these directly to `IKUpload` or the ImageKit REST upload API.
A unique, single-use token generated server-side. Used as the `token` parameter for the ImageKit upload request.
Unix timestamp (seconds) at which this token expires. You must complete the upload before this time. Typical validity window is a few minutes.
HMAC-SHA1 signature computed by the server using your private ImageKit key. Proves to ImageKit that the upload was authorized by your backend.
Your ImageKit public API key (e.g., `"public_xxx"`). Required by the ImageKit SDK to identify your account.
Your ImageKit URL endpoint (e.g., `"https://ik.imagekit.io/demo"`). Use this as the `urlEndpoint` when initializing the ImageKit SDK.
The destination folder path on ImageKit (e.g., `"/ecommerce/reviews"`). Pass this as the `folder` parameter in the upload request.
**Example — Fetch credentials**
```bash cURL theme={null}
curl "https://api.example.com/api/v1/uploads/imagekit-auth?context=reviews" \
-H "Cookie: session="
```
```javascript JavaScript theme={null}
const response = await fetch(
'https://api.example.com/api/v1/uploads/imagekit-auth?context=reviews',
{ credentials: 'include' }
);
const { data } = await response.json();
// data.token, data.expire, data.signature, data.publicKey, data.urlEndpoint, data.folder
```
**Example response**
```json theme={null}
{
"success": true,
"data": {
"token": "a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4",
"expire": 1714005600,
"signature": "3f4a2b1c9d8e7f6a5b4c3d2e1f0a9b8c7d6e5f4a",
"publicKey": "public_ABC123xyz",
"urlEndpoint": "https://ik.imagekit.io/demo",
"folder": "/ecommerce/reviews"
}
}
```
***
## Upload a File with the ImageKit JS SDK
Once you have the signed credentials, use the [ImageKit JavaScript SDK](https://docs.imagekit.io/api-reference/upload-file-api/client-side-file-upload) to upload a file directly from the browser. After a successful upload, extract the `url` from the response and include it in your review request.
```javascript JavaScript theme={null}
import ImageKit from 'imagekit-javascript';
async function uploadReviewImage(file) {
// Step 1: Fetch signed credentials from your API
const authRes = await fetch(
'https://api.example.com/api/v1/uploads/imagekit-auth?context=reviews',
{ credentials: 'include' }
);
const { data: auth } = await authRes.json();
// Step 2: Initialize the ImageKit SDK with your public key and URL endpoint
const imagekit = new ImageKit({
publicKey: auth.publicKey,
urlEndpoint: auth.urlEndpoint,
});
// Step 3: Upload the file using the signed credentials
const uploadResponse = await imagekit.upload({
file, // File object from an element
fileName: file.name, // File name stored on ImageKit
folder: auth.folder, // Destination folder (e.g., "/ecommerce/reviews")
token: auth.token, // Single-use token from the server
expire: auth.expire, // Token expiry (Unix timestamp)
signature: auth.signature, // HMAC signature from the server
});
// Step 4: Return the permanent ImageKit URL for use in the review
return uploadResponse.url;
// e.g. "https://ik.imagekit.io/demo/ecommerce/reviews/my-photo.jpg"
}
// Example usage — create a review with the uploaded image URL
async function submitReview(productId, file) {
const imageUrl = await uploadReviewImage(file);
const csrfRes = await fetch('https://api.example.com/api/v1/auth/csrf-token', {
credentials: 'include',
});
const { data: csrfData } = await csrfRes.json();
await fetch('https://api.example.com/api/v1/reviews', {
method: 'POST',
credentials: 'include',
headers: {
'Content-Type': 'application/json',
'x-csrf-token': csrfData.csrf_token,
},
body: JSON.stringify({
product_public_id: productId,
rating: 5,
title: 'Great product!',
comment: 'Loved it, will buy again.',
images: [
{
image_url: imageUrl,
alt_text: 'My review photo',
},
],
}),
});
}
```
**Error responses**
| Status | Description |
| ------ | -------------------------------------------------------- |
| `401` | Not authenticated. Session cookie is missing or expired. |