API documentation

curl -X POST https://imghost.mgamer.online/api/v1/images/upload \
  -H "Authorization: Bearer hostaura-YOUR_API_KEY" \
  -F "image=@/path/to/photo.png"

<?php
$ch = curl_init('https://imghost.mgamer.online/api/v1/images/upload');
curl_setopt_array($ch, [
    CURLOPT_POST           => true,
    CURLOPT_HTTPHEADER     => ['Authorization: Bearer ' . getenv('HOSTAURA_API_KEY')],
    CURLOPT_POSTFIELDS     => ['image' => new CURLFile('/path/to/photo.png')],
    CURLOPT_RETURNTRANSFER => true,
]);
$response = json_decode(curl_exec($ch), true);

if ($response['success']) {
    echo $response['image']['url'];
} else {
    echo $response['error']['message'];
}

const form = new FormData();
form.append('image', fileInput.files[0]);

const res = await fetch('https://imghost.mgamer.online/api/v1/images/upload', {
  method: 'POST',
  headers: { Authorization: 'Bearer hostaura-YOUR_API_KEY' },
  body: form,
});
const data = await res.json();

if (data.success) console.log(data.image.url);
else console.error(data.error.message);

import os, requests

with open("photo.png", "rb") as f:
    res = requests.post(
        "https://imghost.mgamer.online/api/v1/images/upload",
        headers={"Authorization": f"Bearer {os.environ['HOSTAURA_API_KEY']}"},
        files={"image": f},
        timeout=30,
    )
data = res.json()
print(data["image"]["url"] if data["success"] else data["error"]["message"])

curl "https://imghost.mgamer.online/api/v1/images?page=1&per_page=20" \
  -H "Authorization: Bearer hostaura-YOUR_API_KEY"

<?php
$ch = curl_init('https://imghost.mgamer.online/api/v1/images?page=1&per_page=20');
curl_setopt_array($ch, [
    CURLOPT_HTTPHEADER     => ['Authorization: Bearer ' . getenv('HOSTAURA_API_KEY')],
    CURLOPT_RETURNTRANSFER => true,
]);
$data = json_decode(curl_exec($ch), true);
foreach ($data['images'] as $image) {
    echo $image['id'] . ' ' . $image['url'] . PHP_EOL;
}

const res = await fetch('https://imghost.mgamer.online/api/v1/images?page=1&per_page=20', {
  headers: { Authorization: 'Bearer hostaura-YOUR_API_KEY' },
});
const { images, pagination } = await res.json();
console.log(images.length, 'of', pagination.total);

import os, requests

res = requests.get(
    "https://imghost.mgamer.online/api/v1/images",
    params={"page": 1, "per_page": 20},
    headers={"Authorization": f"Bearer {os.environ['HOSTAURA_API_KEY']}"},
    timeout=30,
)
for image in res.json()["images"]:
    print(image["id"], image["url"])

curl https://imghost.mgamer.online/api/v1/images/img_a8F92kQx \
  -H "Authorization: Bearer hostaura-YOUR_API_KEY"

<?php
$ch = curl_init('https://imghost.mgamer.online/api/v1/images/img_a8F92kQx');
curl_setopt_array($ch, [
    CURLOPT_HTTPHEADER     => ['Authorization: Bearer ' . getenv('HOSTAURA_API_KEY')],
    CURLOPT_RETURNTRANSFER => true,
]);
$data = json_decode(curl_exec($ch), true);
echo $data['image']['width'] . 'x' . $data['image']['height'];

const res = await fetch('https://imghost.mgamer.online/api/v1/images/img_a8F92kQx', {
  headers: { Authorization: 'Bearer hostaura-YOUR_API_KEY' },
});
const { image } = await res.json();
console.log(image.url);

import os, requests

res = requests.get(
    "https://imghost.mgamer.online/api/v1/images/img_a8F92kQx",
    headers={"Authorization": f"Bearer {os.environ['HOSTAURA_API_KEY']}"},
    timeout=30,
)
print(res.json()["image"]["url"])

curl -X DELETE https://imghost.mgamer.online/api/v1/images/img_a8F92kQx \
  -H "Authorization: Bearer hostaura-YOUR_API_KEY"

<?php
$ch = curl_init('https://imghost.mgamer.online/api/v1/images/img_a8F92kQx');
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST  => 'DELETE',
    CURLOPT_HTTPHEADER     => ['Authorization: Bearer ' . getenv('HOSTAURA_API_KEY')],
    CURLOPT_RETURNTRANSFER => true,
]);
$data = json_decode(curl_exec($ch), true);
var_dump($data['deleted']);

const res = await fetch('https://imghost.mgamer.online/api/v1/images/img_a8F92kQx', {
  method: 'DELETE',
  headers: { Authorization: 'Bearer hostaura-YOUR_API_KEY' },
});
console.log((await res.json()).deleted);

import os, requests

res = requests.delete(
    "https://imghost.mgamer.online/api/v1/images/img_a8F92kQx",
    headers={"Authorization": f"Bearer {os.environ['HOSTAURA_API_KEY']}"},
    timeout=30,
)
print(res.json())

<?php
$secret    = getenv('HOSTAURA_WEBHOOK_SECRET');          // whsec_...
$body      = file_get_contents('php://input');
$timestamp = $_SERVER['HTTP_X_WEBHOOK_TIMESTAMP'] ?? '';
$signature = $_SERVER['HTTP_X_WEBHOOK_SIGNATURE'] ?? '';

$expected = 'sha256=' . hash_hmac('sha256', $timestamp . '.' . $body, $secret);

if (!hash_equals($expected, $signature) || abs(time() - (int)$timestamp) > 300) {
    http_response_code(401);
    exit('Invalid signature');
}

$event = json_decode($body, true);
if ($event['event'] === 'image.uploaded') {
    // $event['image']['url'] ...
}
http_response_code(200);

import crypto from 'node:crypto';
import express from 'express';

const app = express();

app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const timestamp = req.get('X-Webhook-Timestamp') ?? '';
  const signature = req.get('X-Webhook-Signature') ?? '';
  const expected = 'sha256=' + crypto
    .createHmac('sha256', process.env.HOSTAURA_WEBHOOK_SECRET)
    .update(`${timestamp}.${req.body}`)
    .digest('hex');

  const ok = signature.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
  if (!ok || Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) {
    return res.status(401).send('Invalid signature');
  }

  const event = JSON.parse(req.body);
  console.log(event.event, event.image?.url);
  res.sendStatus(200);
});

import hashlib, hmac, os, time
from flask import Flask, request, abort

app = Flask(__name__)

@app.post("/webhook")
def webhook():
    body = request.get_data()                       # raw bytes
    timestamp = request.headers.get("X-Webhook-Timestamp", "")
    signature = request.headers.get("X-Webhook-Signature", "")
    expected = "sha256=" + hmac.new(
        os.environ["HOSTAURA_WEBHOOK_SECRET"].encode(),
        timestamp.encode() + b"." + body,
        hashlib.sha256,
    ).hexdigest()

    if not hmac.compare_digest(expected, signature) or abs(time.time() - int(timestamp or 0)) > 300:
        abort(401)

    event = request.get_json()
    print(event["event"], event.get("image", {}).get("url"))
    return "", 200