ForHosting KIT · Images

Validate an image

An upload form that trusts the browser's file extension is a support ticket waiting to happen. The image validation API inspects the actual file bytes, not the filename, and reports back format, pixel dimensions and weight in kilobytes so your backend can accept or reject an upload with certainty. It answers one question precisely: is this file what it claims to be, and does it fit your limits?

● StableFree · in your browser

Run — free How it works & API

Use it from WebAPIEmailApp soonTelegram soon

The gap between 'file.jpg' and an actual JPEG

Browsers and users lie to upload forms constantly, sometimes on purpose and often by accident: a renamed file, a corrupted download, a HEIC saved with a .jpg extension. Checking a MIME type header or a file extension catches none of that, because both are supplied by the client and trivially wrong. This endpoint opens the file and reads its actual signature and structure, which is the only reliable way to know what you're really holding.

What gets checked

POST an image to /image/validate and the task returns the detected format, width and height in pixels, and file size in kilobytes, along with a pass or fail flag against whatever constraints you specify — maximum weight, minimum or maximum dimensions, allowed formats. That single structured answer is what a backend needs to decide, in one branch of logic, whether to store the file or bounce it back to the user with a specific reason.

Where this sits in an upload pipeline

Most teams call this endpoint the moment a file lands, before it touches permanent storage, a CDN or a database record. Because the check runs asynchronously, an upload flow fires the request and either waits briefly for the webhook on a small form or queues the file for later confirmation on a bulk import — either pattern avoids holding a request thread open while an image is inspected byte by byte.

Who this protects

Marketplaces validating seller-uploaded product photos, user-generated-content platforms filtering profile pictures before they ever get processed further, and internal tools accepting design assets from external contractors all rely on this endpoint for the same reason: catching a bad file at the door is cheaper than debugging why it broke a downstream resize job three steps later.

Straightforward, honest pricing

Validation is billed at a single flat fee per request — no per-image multiplier, since one file in means one check out. A request that fails due to a transient error is retried automatically up to three times before returning a clear error, and you are never charged for a failed task, only for a completed validation result.

What you can do with it

Marketplace product photo intake

A seller uploads a product photo and the platform validates it is a real JPEG or PNG under the size cap before it ever reaches the listing pipeline.

User avatar upload gate

A social app checks that a profile picture upload is an actual image within dimension limits before generating thumbnails, avoiding wasted processing on bad files.

Bulk contractor asset intake

An agency receiving hundreds of design assets from a freelancer validates every file against format and weight rules before importing them into the project.

CMS media library guardrail

A content team's CMS validates every media upload against a size and format policy so editors can't accidentally publish an oversized or wrong-format image.

FAQ

What does the image validation API actually check?

It inspects the real file bytes to detect the true format, then reports pixel width and height and file weight in kilobytes, flagging whether the file passes the format, size and dimension limits you define.

Does it catch mislabeled files, like a HEIC saved as .jpg?

Yes, because the check reads the file's actual signature and structure rather than trusting the extension or MIME type sent by the client.

Which formats can be validated?

JPEG, PNG, WebP and GIF are all detected and validated; the response tells you exactly which format was found, whether or not it matches what you expected.

Can I set my own size and dimension limits?

Yes, you pass the constraints — maximum weight, minimum or maximum width and height, allowed formats — and the result includes a clear pass or fail against those rules.

Is the image validation API free?

The tool above runs free in your browser. The API is paid — each call draws from your prepaid ForHosting KIT balance: top up from $10.00 (it never expires), pay each request's published price, and a call with no balance returns HTTP 402. No subscription, no tokens, and a failed task is never charged.

How fast do I get a result?

The task runs asynchronously and returns a task_id immediately; the validation result arrives via signed webhook, or you can retrieve it from a signed link valid for 24 hours.

What happens with corrupted or unreadable files?

A genuinely unreadable file returns a clear failed-format result rather than an error, so your backend can reject it with a specific reason instead of guessing.

Can I validate a large batch of images at once?

Each request validates one image, so a bulk import calls the endpoint once per file; since it's billed at a flat rate per request, cost scales predictably with volume.

For developers — API access

Everything on this page is available programmatically. This section is for teams who want to wire it into their own systems; everyone else can just use the tool above.

API endpoint

POSThttps://api.kit.forhosting.com/image/validate

Prefer to automate it? One authenticated POST creates the task; the result comes back by webhook or a signed link. The same capability also runs here on the web, and soon from our app, email and Telegram.

Call it from your stack

curl -X POST https://api.kit.forhosting.com/image/validate \
  -H "Authorization: Bearer $KIT_KEY" \
  -H "Content-Type: application/json" \
  -d &#39;{"image":"https://ejemplo.com/imagen.jpg"}'

const res = await fetch("https://api.kit.forhosting.com/image/validate", {
  method: "POST",
  headers: {
    "Authorization": `Bearer ${process.env.KIT_KEY}`,
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    "image": "https://ejemplo.com/imagen.jpg"
  })
});
const { task_id } = await res.json();

import os, requests

res = requests.post(
    "https://api.kit.forhosting.com/image/validate",
    headers={"Authorization": f"Bearer {os.environ[&#39;KIT_KEY']}"},
    json={
    "image": "https://ejemplo.com/imagen.jpg"
},
)
task_id = res.json()["task_id"]

<?php
$res = file_get_contents("https://api.kit.forhosting.com/image/validate", false, stream_context_create([
  "http" => [
    "method"  => "POST",
    "header"  => "Authorization: Bearer " . getenv("KIT_KEY") . "\r\nContent-Type: application/json",
    "content" => &#39;{"image":"https://ejemplo.com/imagen.jpg"}',
  ],
]));
$task = json_decode($res, true);

body := bytes.NewBufferString(`{"image":"https://ejemplo.com/imagen.jpg"}`)
req, _ := http.NewRequest("POST", "https://api.kit.forhosting.com/image/validate", body)
req.Header.Set("Authorization", "Bearer "+os.Getenv("KIT_KEY"))
req.Header.Set("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)

Example request

{
  "image": "https://ejemplo.com/imagen.jpg"
}

Example response

{
  "task_id": "tsk_a1b2c3d4e5f6a1b2c3d4e5f6",
  "type": "image.validate",
  "status": "queued",
  "_links": {
    "result": "/tasks/tsk_…/result"
  }
}

The API is asynchronous: the call returns a task_id immediately and the result arrives by webhook. Polling is capped at 1 req/s per task.

Pricing

Per request$0.002

Published price — no tokens, no invented credits. A failed task is never charged.

Limits

`max_mb`	15
`max_megapixels`	12

Errors

HTTP	Code	Meaning
`401`	`unauthorized`	Missing or invalid API key.
`402`	`insufficient_balance`	Your balance doesn't cover the task price.
`404`	`unknown_type`	That task type doesn't exist.
`429`	`rate_limited`	Too many requests. Use the webhook instead of polling.

Read the full KIT documentation →

Run — free