The Gallery

What it is

The Gallery stores the image you uploaded and sends those same bytes. The Crown may cache them. You can block other sites from hotlinking. Zipper does not resize, convert to AVIF/WebP, strip EXIF, or transcode.

Cloudflare analogue: Cloudflare Images (delivery only — not Polish). SLA 99.9% · p99 55ms. Operators upload originals. Transform params on /cdn-cgi/image are recorded and ignored.

• ▸Original bytes only
• ▸Stored objects
• ▸Crown cache
• ▸Hotlink guard

How it works

PUT original image bytes at /api/v1/gallery/objects. Request them at /gate/{hostname}/_gallery/{key}. The Crown may cache the original.

A Cloudflare-shaped /cdn-cgi/image/{width=800,format=avif}/{key} URL is accepted. Zipper records the params in X-Zipper-Requested and still returns the stored file. Bytes are not resized, converted, or stripped.

Remote fetch (https://… inside the image path) is refused. Hotlink guard refuses foreign Referers.

Use cases

Concrete ways teams use this service on day one.

Set it up in the dashboard

Dashboard → Services → The Gallery. Upload the original. Zipper does not transcode.

API

Control-plane: PUT /api/v1/gallery/objects · GET|_gallery/{key}. Send Authorization: Bearer tz_live_YOUR_TOKEN.

Creates count against the plan quota. A 402 plan_limit means you are at the cap — upgrade or delete an unused resource.

curl -sS -X PUT https://tinyzipper.com/api/v1/gallery/objects \
  -H "Authorization: Bearer tz_live_YOUR_TOKEN" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{"key":"hero.jpg","body_base64":"<jpeg-base64>"}'

const res = await fetch("https://tinyzipper.com/api/v1/gallery/objects", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.ZIPPER_TOKEN}`,
    "Content-Type": "application/json"
  }
});
const json = await res.json();
if (!res.ok) throw new Error(json.error ?? res.statusText);
console.log(json);

Tips

Upload the size and format you want visitors to see. Gallery will not invent AVIF.

• ▸Original bytes
• ▸Global Server

Runbook

PUT original images. Serve at /_gallery/{key}. /cdn-cgi/image/{params}/{key} is accepted and ignored — bytes are never resized or converted. Cache in The Crown. Block hotlinks.