Skip to content
FrameKit Docs

HTTP API

FrameKit exposes a Node.js HTTP handler for optional Studio access and synchronous PNG rendering. In the canonical project, mount it from the App Router catch-all route at /api/framekit/[...action] and keep that route on the Node.js runtime. The existing-project integration shows the complete route setup.

The dispatcher exposes only the routes documented in this section. POST /api/framekit/images/render is the image endpoint in both modes. The other routes manage the Studio session, account, API tokens, and users only when FRAMEKIT_AUTH_ENABLED=true; in open mode they return 404 not_found.

Choose a reference

Section titled “Choose a reference”
Access APIThe common contract and complete route map.
Account APILogin, logout, account, and password operations.
Token APIAPI token creation, listing, and revocation.
User-management APIAdministrator user management and user token metadata.
Access API errorsStable access status and error codes.
Image render APIEndpoint, authentication, and the PNG response.
Image inputsTemplate data and supported image sources.
Image API errorsStable image-render status and error codes.

Common response rules

Section titled “Common response rules”

Access responses are JSON and use Cache-Control: no-store. Image errors are also JSON and use Cache-Control: no-store; a successful image response is a PNG with the same cache directive. Clients should branch on the documented error code rather than parsing human-readable messages.

The API is synchronous. In authenticated mode, a render request is authenticated before the request is parsed. In open mode, credentials are not checked, but the renderer’s defenses remain in place. The request then resolves the template and its data, starts the server-side Chromium render, and returns the PNG bytes in the same response.

Security boundary

Section titled “Security boundary”

The session cookie is for same-origin Studio access when authentication is enabled. A Bearer API token is accepted only by the image render endpoint and only in authenticated mode. In open mode the image endpoint needs no credential. Do not put a token in a URL, browser bundle, rendered DOM, or client-side code. Read Security and reverse proxies before exposing the handler publicly.