Documentation

Build on imageserver.pw

Upload files, shorten URLs, create pastes, convert images and understand what happens to your data. One key authenticates every endpoint: the AUTH-Key under Settings › Security in your dashboard.

ShareX setup

Make imageserver your ShareX uploader in two minutes, with expiry, folders and fixes for the errors people run into.

Read the setup guide

Upload API

Post a file over HTTP and get an encrypted share link plus a deletion link back. Includes ShareX, Postman and four language examples.

Read the upload docs

Shortener API

Turn any URL into a short link, with a random or a vanity code, on our domains or on one of your own.

Read the shortener docs

Paste API

Pipe logs and code into an encrypted, highlighted paste with one curl command. Raw text or JSON, with expiry and delete after reading.

Read the paste docs

Conversion API

Send an image and get it back converted, resized, watermarked or without its metadata. Nothing is stored. Part of the paid plans.

Read the conversion docs

Encryption

What AES-256, HKDF and the key in your link actually mean, what our server can still see, and how to decrypt your uploads in the dashboard.

Read the encryption docs

ShareX Config Creator

Not a developer? Generate a ready to import ShareX preset with your key and domains already filled in.

Open the generator

Authentication

Every endpoint on this site uses the same credential: your personal key, shown as AUTH-Key in the dashboard and called the user key in error messages. Send it in the X-IMAGESERVER-AUTH-KEY header. The Upload, Shortener and Conversion APIs also take it as a userKey body field for clients that cannot set headers; the Paste API reads the header only, because its body is the text itself.

X-IMAGESERVER-AUTH-KEY: your-user-key

Treat the key like a password

Anyone holding it can upload under your account and consume your quota. If it leaks, renew it under Settings › Security in the dashboard, which immediately invalidates the old one.

All endpoints at a glance

Method	Path	Rate limit	Purpose
POST	`/api/v1/upload`	30 / min, shared with paste	Upload a file, docs
POST	`/api/v1/shorten`	30 / min	Create a short link, docs
POST	`/api/v1/paste`	30 / min, shared with upload	Create a paste from raw text or JSON, docs
POST	`/api/v1/convert`	60 / min, daily allowance	Convert an image, paid plans, docs
GET	`/delete/:key?key=…`	10 / min	Confirmation page for deleting an upload; the file goes when the button there is pressed. No auth key needed, docs
GET	`/s/delete/:code?key=…`	10 / min	Confirmation page for deleting a short link, the same way. No auth key needed

Rate limits are counted per user key, falling back to the client IP when no key is present. Requests with a key that does not exist are also counted per IP, across all endpoints, and after 20 of them in ten minutes that IP is refused for a while. Exceeding a limit returns 429 with a JSON error body.

Conventions used here

Base URL is https://imageserver.pw. If you connected a custom domain, it answers the same paths.
Responses are JSON unless a page says otherwise: the Conversion API answers with the image itself, and the Paste API can answer with the bare link. Errors are JSON in the shape { "error": "..." }, with the exceptions listed in each page's error table.
Placeholders look like your-user-key. Replace them with your own value and keep any quotes around them.
Every upload is encrypted server side before it is written to disk. Nothing you send has to be pre-encrypted.