Skip to main content
Cloud runs the same API as self-hosted. One path differs, six endpoints do not exist, and quotas add one status code. Everything else, request and response, is documented once in the API reference. One host serves both the API and the CDN. Send your key on every call, either header works.
Keys are created in the dashboard under Settings → API keys, shown once, and pinned to a single bucket. That is why no endpoint takes a bucket ID: the key carries it. See create an API key. The dashboard at https://app.openinary.dev is not an API.

​
The bucket prefix

Delivery is the one path that differs. It is public and needs no key.
Self-hosted, the same URL is {base}/t/{transformations}/{path}. Only the prefix changes: the transformation syntax after it is identical, and so is every other endpoint. See your base URL. The bucketId is the /b/.../ segment of the url an upload returns. It appears in every public URL you serve, so it is not a secret.

​
What Cloud has

Every endpoint below behaves exactly as the shared reference describes it.

​
What Cloud does not have (yet)

The transformations field on POST /upload, which prewarms variants on self-hosted, is accepted and ignored. Variants are generated on the first request instead.

​
Presigned uploads

POST /upload/sign works as the shared reference describes. The token names the account, bucket and folder it was minted for, so it cannot be replayed against another bucket. A signature that fails verification returns 401 Invalid or expired upload signature, a Cloud-specific message. See File Uploader on Cloud for the full browser flow.

​
Video processing

Identical to self-hosted. The first request for a transformed video returns 202, and you poll /video-status or subscribe to /queue/events until it reports completed. A video URL carrying no parameters is never transcoded. It streams the stored file with range requests, so seeking works, and costs no processing minutes.

​
Errors

Same error shape as self-hosted, plus one status code of its own. A 402 names the allowance that ran out:
feature is one of storage_mb, image_transformations, video_processing_seconds or cdn_requests. Past the transformation quota, cached assets keep being served and only new work is refused. See plans and limits.

​
Rate limits

Both apply to the /b/* delivery path only, and both answer 429. Upload, signing and storage calls are not rate limited. They exist to stop abuse rather than to shape normal traffic, so get in touch before you expect to run against them.

API Reference

Every endpoint, documented once for both deployments.

Cloud Quickstart

Account, key, first upload, first transformed URL.

Account & buckets

Buckets, plans, limits and billing.

File Uploader on Cloud

Browser uploads with no key in the bundle.