Documentation

Build on imageserver.pw

Upload files, shorten URLs and understand what happens to your data. One key authenticates every endpoint, and you find it in your dashboard.

Upload API

Post a file over HTTP and get an encrypted share link plus a deletion link back. Includes ShareX, Postman and four language examples.

Read the upload docs

Shortener API

Turn any URL into a short link, with a random or a vanity code, on our domains or on one of your own.

Read the shortener docs

Encryption

What AES-256-CBC, scrypt and the key in your link actually mean, and how to decrypt your uploads in the dashboard.

Read the encryption docs

ShareX Config Creator

Not a developer? Generate a ready to import ShareX preset with your key and domains already filled in.

Open the generator

Authentication

Every endpoint on this site uses the same credential: your personal user key. Send it in the X-IMAGESERVER-AUTH-KEY header, or as a userKey field in the request body if your client cannot set headers.

X-IMAGESERVER-AUTH-KEY: your-user-key

Treat the key like a password

Anyone holding it can upload under your account and consume your quota. If it leaks, regenerate it in the dashboard, which immediately invalidates the old one.

All endpoints at a glance

Method	Path	Rate limit	Purpose
POST	`/api/v1/upload`	30 / min	Upload a file, docs
POST	`/api/v1/shorten`	30 / min	Create a short link, docs
GET	`/delete/:key?key=…`	10 / min	Delete an upload, no auth key needed
GET	`/s/delete/:code?key=…`	10 / min	Delete a short link, no auth key needed

Rate limits are counted per user key, falling back to the client IP when no key is present. Exceeding one returns 429 with a JSON error body.

Conventions used here

Base URL is https://imageserver.pw. If you connected a custom domain, it answers the same paths.
Success responses are JSON. Errors are JSON too, in the shape { "error": "..." }, with the exception noted on each page.
Placeholders look like your-user-key. Replace them, including the surrounding quotes where shown.
Every upload is encrypted server side before it is written to disk. Nothing you send has to be pre-encrypted.