Imagine is a hosted image catalog API: search curated photos from Unsplash, Pexels and Pixabay, served from our CDN with consistent size variants. All endpoints are JSON over HTTPS.

Base URL   https://imagine.rtools.in/api/v1
Local dev  http://localhost:3000/api/v1

Every request: Authorization: Bearer imk_live_…

Responses use a consistent envelope — data on success, error on failure — and every response carries an x-request-id header for support.

Every account gets one API key at signup — send it as a Bearer token on each request. Keys are stored as hashes server-side; the plaintext is shown once, so copy it when you see it. Rotate it anytime from the dashboard — the old key stops working immediately.

curl -H "Authorization: Bearer imk_live_…" \
  "https://imagine.rtools.in/api/v1/images/search?q=mountains"

The API is plain JSON over HTTPS — any HTTP client works. Keep the key in an environment variable, send it as a Bearer token, and read the error envelope on non-2xx responses. For server-side calls, enable “Allow server-to-server” on your key; for browser apps, add your domain to the allowlist instead.

// Node 18+ — built-in fetch, no dependencies
const API_KEY = process.env.IMAGINE_API_KEY; // imk_live_…
const BASE = "https://imagine.rtools.in";

async function searchImages(query, page = 1) {
  const url = new URL("/api/v1/images/search", BASE);
  url.searchParams.set("q", query);
  url.searchParams.set("per_page", "10");
  url.searchParams.set("page", String(page));

  const res = await fetch(url, {
    headers: { Authorization: "Bearer " + API_KEY },
  });

  const body = await res.json();
  if (!res.ok) {
    // envelope: { error: { code, message, requestId } }
    const e = body.error ?? {};
    throw new Error(res.status + " " + (e.code ?? "") + ": " + (e.message ?? res.statusText));
  }
  return body; // { data: ImageDTO[], pagination: {...} }
}

const { data, pagination } = await searchImages("mountains");
for (const img of data) {
  console.log(img.title, "→", img.urls.medium ?? img.urls.original);
}
console.log(pagination.total + " results, page " + pagination.page);

Keys can be locked to your domains. On browser requests the API checks the Origin/Referer against your allowlist — listed domains match themselves and all subdomains (example.com covers app.example.com).

• Allowed domains — empty list = any origin allowed. Add yours to lock the key down.
• Allow localhost — off by default; enable while developing.
• Allow server-to-server — requests without an Origin header (curl, backend code). Keep on for server integrations.

Every response reports your quota:

x-ratelimit-limit      1200        # hourly cap
x-ratelimit-remaining  1187        # left this window
x-ratelimit-reset      1735689600  # epoch seconds
x-usage-limit          2000        # trial: lifetime cap
x-usage-remaining      437         # trial: lifetime remaining

A 429 means you hit the cap — wait for x-ratelimit-reset or upgrade. Trial keys keep working after 2,000 requests at a 10/hr trickle so your integration never hard-fails during testing.