Account API

Full website and API key CRUD over a bearer-authenticated REST API, for agencies and resellers on the Reseller + AI plan.

The Account API gives agencies and resellers full programmatic control over their helloIMG account: create, rename, and delete websites, mint and revoke the himg_live_ keys each website uses, and read usage — all without touching the dashboard.

This is a reseller feature. It requires a reseller account on the Reseller + AI plan — contact us to have reseller status enabled on your account, then subscribe to Reseller + AI from the dashboard's Billing page.

Getting a key

Once your account has reseller status, account keys are minted from Settings → Account API → Create key in the helloIMG dashboard.

The full key — himg_acct_... — is shown once, at creation time. Store it somewhere safe; helloIMG only ever keeps its hash and can't show it to you again. Up to 10 active account keys per account — revoke one before minting past that.

Both account keys and website keys can only be minted once the account's email address is verified. An unverified account gets a 403 on any key-creation call — see Errors.

Authentication

Send the key as a bearer token on every request:

Terminal

Authorization: Bearer himg_acct_xxxxxxxx_************

Base URL:

https://app.helloimg.io/portal/account

Requests are rate-limited to 10 requests/second (burst 20), both per calling IP and per key — whichever limit you hit first answers 429. Every error comes back as JSON:

{ "error": "..." }

Endpoints

Account

GET /me

Terminal

curl https://app.helloimg.io/portal/account/me \
  -H "Authorization: Bearer himg_acct_xxxxxxxx_************"

{
  "id": "3f9c1a2b-6d4e-4f8a-9c3b-1a2b3c4d5e6f",
  "email": "[email protected]",
  "plan": "reseller_ai",
  "website_count": 12,
  "key_count": 3
}

Websites

GET /websites
POST /websites
PATCH /websites/{id}
DELETE /websites/{id}

List:

Terminal

curl https://app.helloimg.io/portal/account/websites \
  -H "Authorization: Bearer himg_acct_xxxxxxxx_************"

{
  "websites": [
    {
      "id": "7f3a1c92-6b4d-4e8f-9a21-5c6d7e8f9a0b",
      "domain": "client-site.example.com",
      "name": "Client Site",
      "created_at": "2026-08-01T12:00:00Z",
      "active_key_count": 1
    }
  ]
}

Create:

Terminal

curl -X POST https://app.helloimg.io/portal/account/websites \
  -H "Authorization: Bearer himg_acct_xxxxxxxx_************" \
  -H "Content-Type: application/json" \
  -d '{"domain":"client-site.example.com","name":"Client Site"}'

{
  "id": "7f3a1c92-6b4d-4e8f-9a21-5c6d7e8f9a0b",
  "domain": "client-site.example.com",
  "name": "Client Site"
}

name is optional. domain must look like a real hostname — at least one dot, lowercase a-z0-9- labels, no more than 253 characters — or the call answers 400. A domain already registered on your account answers 409 instead of creating a duplicate.

Rename:

Terminal

curl -X PATCH https://app.helloimg.io/portal/account/websites/7f3a1c92-6b4d-4e8f-9a21-5c6d7e8f9a0b \
  -H "Authorization: Bearer himg_acct_xxxxxxxx_************" \
  -H "Content-Type: application/json" \
  -d '{"name":"New Client Name"}'

204 on success, no body. name is required on this call — omit it (or send it as null) and you get a 400, unlike POST /websites where it's optional.

Delete:

Terminal

curl -X DELETE https://app.helloimg.io/portal/account/websites/7f3a1c92-6b4d-4e8f-9a21-5c6d7e8f9a0b \
  -H "Authorization: Bearer himg_acct_xxxxxxxx_************"

204 on success. Deleting a website revokes every one of its keys along with it.

Website keys

POST /websites/{id}/keys
GET /websites/{id}/keys
DELETE /websites/{id}/keys/{prefix}

Mint:

Terminal

curl -X POST https://app.helloimg.io/portal/account/websites/7f3a1c92-6b4d-4e8f-9a21-5c6d7e8f9a0b/keys \
  -H "Authorization: Bearer himg_acct_xxxxxxxx_************" \
  -H "Content-Type: application/json" \
  -d '{"name":"Production"}'

{
  "id": "2b9e4f7a-1d3c-4a6b-8f0e-9c8d7e6f5a4b",
  "name": "Production",
  "prefix": "h4k2x9mq",
  "key": "himg_live_h4k2x9mq_************************************"
}

name is optional. key is the full himg_live_ key — this is what you configure in the LW Image WordPress plugin on the client's site. It's shown once; only prefix is ever retrievable afterwards. Max 2 active keys per website — 409 past that, revoke one first.

List:

Terminal

curl https://app.helloimg.io/portal/account/websites/7f3a1c92-6b4d-4e8f-9a21-5c6d7e8f9a0b/keys \
  -H "Authorization: Bearer himg_acct_xxxxxxxx_************"

{
  "keys": [
    {
      "id": "2b9e4f7a-1d3c-4a6b-8f0e-9c8d7e6f5a4b",
      "name": "Production",
      "prefix": "h4k2x9mq",
      "created_at": "2026-08-01T12:00:00Z",
      "last_used_at": "2026-08-20T09:14:32Z"
    }
  ]
}

The secret is never returned after the mint response — only prefix.

Revoke:

Terminal

curl -X DELETE https://app.helloimg.io/portal/account/websites/7f3a1c92-6b4d-4e8f-9a21-5c6d7e8f9a0b/keys/h4k2x9mq \
  -H "Authorization: Bearer himg_acct_xxxxxxxx_************"

204 on success.

Usage

GET /usage

Terminal

curl https://app.helloimg.io/portal/account/usage \
  -H "Authorization: Bearer himg_acct_xxxxxxxx_************"

{
  "plan": "reseller_ai",
  "month": "2026-08",
  "websites": [
    {
      "website_id": "7f3a1c92-6b4d-4e8f-9a21-5c6d7e8f9a0b",
      "domain": "client-site.example.com",
      "images": 4213,
      "bytes_saved": 891234567,
      "limit": -1,
      "over_limit": false
    }
  ]
}

Current calendar month, per website: images processed and bytes saved. limit and over_limit are account-wide values repeated on every entry — Reseller + AI carries no image cap, so limit is always -1.

Errors

Status	Body	Cause
`400`	`{ "error": "invalid json" }`	The request body isn't valid JSON, on `POST /websites` or `POST /websites/{id}/keys`.
`400`	`{ "error": "invalid domain" }`	`domain` isn't a valid hostname shape on `POST /websites` — see Websites.
`400`	`{ "error": "name too long" }`	`name` is over 200 characters, on a website or a key.
`400`	`{ "error": "name required" }`	`PATCH /websites/{id}` was called without a `name` field (or the body wasn't valid JSON).
`401`	`{ "error": "invalid account key" }`	Missing, malformed, unknown, or revoked bearer key.
`403`	`{ "error": "reseller plan required" }`	The account isn't flagged as a reseller, or isn't on the Reseller + AI plan.
`403`	`{ "error": "email verification required" }`	The account's email isn't verified yet — blocks minting a key on `POST /websites/{id}/keys`.
`404`	`{ "error": "not found" }`	The website or key doesn't exist, or belongs to a different account.
`409`	`{ "error": "website already registered" }`	That domain is already on your account.
`409`	`{ "error": "two active keys already — revoke one before minting another" }`	The target website already has 2 active keys.
`429`	`{ "error": "too many requests" }`	Rate limit exceeded — retry after the `Retry-After` header.

Notes

The himg_live_ website keys minted here are exactly what you configure in the LW Image WordPress plugin for each client site.
Account keys (himg_acct_...) and website keys (himg_live_...) are not interchangeable — an account key never works as an image-API key, and a website key never authenticates against the Account API.
Ownership errors always come back as 404, whether the resource doesn't exist at all or just belongs to a different account.

AI background removal

POST /v1/ai/bg-remove — send an image, get back a transparent PNG with the background removed.