ImageKit Upload Auth — Get Signed Upload Credentials

The ImageKit Upload Auth endpoint provides short-lived, signed credentials that allow your browser or mobile app to upload images directly to ImageKit — without routing file data through your own server. Fetch these credentials just before each upload, pass them to the ImageKit JS SDK, and then use the resulting ImageKit URL when creating or updating a review.

The URLs that ImageKit returns after a successful upload are the values you should pass as image_url in the images array when calling POST /reviews or PATCH /reviews/{review_public_id}. The server validates that image URLs originate from the allowed ImageKit endpoint before saving them.

Get Upload Credentials

Retrieve a signed token, signature, and configuration needed to perform a direct browser upload via the ImageKit JS SDK.

GET /uploads/imagekit-auth

Authentication: Requires an active session cookie. Unauthenticated requests return 401 Unauthorized. Query parameters

string

default:"reviews"

Controls which ImageKit folder the uploaded file is placed in. Accepted values:

reviews (default) — uploads go to /ecommerce/reviews/
products — uploads go to the product images folder

Unknown values fall back silently to reviews.

Response fields

object

Signed ImageKit authentication parameters. Pass these directly to IKUpload or the ImageKit REST upload API.

Show Credential fields

string

A unique, single-use token generated server-side. Used as the token parameter for the ImageKit upload request.

integer

Unix timestamp (seconds) at which this token expires. You must complete the upload before this time. Typical validity window is a few minutes.

string

HMAC-SHA1 signature computed by the server using your private ImageKit key. Proves to ImageKit that the upload was authorized by your backend.

string

Your ImageKit public API key (e.g., "public_xxx"). Required by the ImageKit SDK to identify your account.

string

Your ImageKit URL endpoint (e.g., "https://ik.imagekit.io/demo"). Use this as the urlEndpoint when initializing the ImageKit SDK.

string

The destination folder path on ImageKit (e.g., "/ecommerce/reviews"). Pass this as the folder parameter in the upload request.

Example — Fetch credentials

curl "https://api.example.com/api/v1/uploads/imagekit-auth?context=reviews" \
  -H "Cookie: session=<your-session-token>"

const response = await fetch(
  'https://api.example.com/api/v1/uploads/imagekit-auth?context=reviews',
  { credentials: 'include' }
);
const { data } = await response.json();
// data.token, data.expire, data.signature, data.publicKey, data.urlEndpoint, data.folder

Example response

{
  "success": true,
  "data": {
    "token": "a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4",
    "expire": 1714005600,
    "signature": "3f4a2b1c9d8e7f6a5b4c3d2e1f0a9b8c7d6e5f4a",
    "publicKey": "public_ABC123xyz",
    "urlEndpoint": "https://ik.imagekit.io/demo",
    "folder": "/ecommerce/reviews"
  }
}

Upload a File with the ImageKit JS SDK

Once you have the signed credentials, use the ImageKit JavaScript SDK to upload a file directly from the browser. After a successful upload, extract the url from the response and include it in your review request.

JavaScript

import ImageKit from 'imagekit-javascript';

async function uploadReviewImage(file) {
  // Step 1: Fetch signed credentials from your API
  const authRes = await fetch(
    'https://api.example.com/api/v1/uploads/imagekit-auth?context=reviews',
    { credentials: 'include' }
  );
  const { data: auth } = await authRes.json();

  // Step 2: Initialize the ImageKit SDK with your public key and URL endpoint
  const imagekit = new ImageKit({
    publicKey: auth.publicKey,
    urlEndpoint: auth.urlEndpoint,
  });

  // Step 3: Upload the file using the signed credentials
  const uploadResponse = await imagekit.upload({
    file,                        // File object from an <input type="file"> element
    fileName: file.name,         // File name stored on ImageKit
    folder: auth.folder,         // Destination folder (e.g., "/ecommerce/reviews")
    token: auth.token,           // Single-use token from the server
    expire: auth.expire,         // Token expiry (Unix timestamp)
    signature: auth.signature,   // HMAC signature from the server
  });

  // Step 4: Return the permanent ImageKit URL for use in the review
  return uploadResponse.url;
  // e.g. "https://ik.imagekit.io/demo/ecommerce/reviews/my-photo.jpg"
}

// Example usage — create a review with the uploaded image URL
async function submitReview(productId, file) {
  const imageUrl = await uploadReviewImage(file);

  const csrfRes = await fetch('https://api.example.com/api/v1/auth/csrf-token', {
    credentials: 'include',
  });
  const { data: csrfData } = await csrfRes.json();

  await fetch('https://api.example.com/api/v1/reviews', {
    method: 'POST',
    credentials: 'include',
    headers: {
      'Content-Type': 'application/json',
      'x-csrf-token': csrfData.csrf_token,
    },
    body: JSON.stringify({
      product_public_id: productId,
      rating: 5,
      title: 'Great product!',
      comment: 'Loved it, will buy again.',
      images: [
        {
          image_url: imageUrl,
          alt_text: 'My review photo',
        },
      ],
    }),
  });
}

Error responses

Status	Description
`401`	Not authenticated. Session cookie is missing or expired.

Auth & Sessions

Account

Catalog

Cart & Checkout

Reviews

ImageKit Upload Auth — Get Signed Upload Credentials

Get Upload Credentials

Upload a File with the ImageKit JS SDK

​Get Upload Credentials

​Upload a File with the ImageKit JS SDK

Get Upload Credentials

Upload a File with the ImageKit JS SDK