> ## Documentation Index
> Fetch the complete documentation index at: https://docs.openinary.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Authenticated Transform

> Apply transformations via a signed URL that cannot be guessed or tampered with

**Self-hosted only.** Signed delivery URLs are not available on Cloud yet.

Same transformations as the public `/t/` endpoint, behind an HMAC-SHA256 signature. Use it for private media, or to restrict which transformations can be applied.

```
GET /authenticated/s--{signature}/{transformations}/{path}
```

```http theme={null}
GET /authenticated/s--a1b2c3d4e5f6a7b8/w_400,h_400,c_fill/private/photo.jpg
```

**Auth:** Signature verification (no API key needed at request time)

## Path parameters

| Param | Type | Description |
| - | - | - |
| `signature` | `string` | Required. 16 hex characters, truncated from the full HMAC-SHA256 digest |
| `transformations` | `string` | Comma-separated parameters, identical to the public `/t/` endpoint |
| `path` | `string` | Required. Path to the file, identical to the public `/t/` endpoint |

The signature is computed server-side over the transformations plus the file path, using `API_SECRET` as the HMAC key. Both must match what was signed, since any change to the URL invalidates the signature. A signature of any other length is rejected with `400` before the value is even checked.

See [Signed URLs](https://docs.openinary.dev/media-transformations/signed-urls.md) for code examples on generating signatures.

## Response

Same as the [public transform endpoint](https://docs.openinary.dev/api-reference/media/transform.md), returns binary file content.

| Code | Meaning |
| - | - |
| `200` | Transformed file returned |
| `400` | Invalid URL format, wrong signature length, or transformation parameters on a [non-transformable type](https://docs.openinary.dev/api-reference/media/transform.md#pass-through-formats) |
| `401` | Signature does not match, tampered or wrong secret |
| `404` | File not found |

## Related

> [card] [Signed URLs guide](https://docs.openinary.dev/media-transformations/signed-urls.md)
>
> How to generate signed URLs from your backend.

> [card] [Public Transform](https://docs.openinary.dev/api-reference/media/transform.md)
>
> Unrestricted on-the-fly transformations.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.