Agentic Fabriq
ImageKit
DOCS & KNOWLEDGE · FILES & DOCS
Files, folders, versions, and their metadata in the media library they connected.
Connecting ImageKit in practice
ImageKit publishes its rate limits as guidance rather than a fixed number: stay near or below 40 requests a second on reads with bursts to 100, but only 5 to 20 a second on writes, and bulk tag operations are capped at 5 a second. The upload API is the one endpoint exempt from rate limiting altogether.
Scopes that draw scrutiny
private_ keyThe HTTP Basic credential for every server-side API. ImageKit’s own guidance is that it must never be embedded in client code, unlike the public_ key which is designed to be.Standard keyRead and write access to all APIs, with a hard maximum of 5 per account.Restricted keyThe only way to narrow access: None, Read only or Read and write per resource across media management and account management. Also capped at 5 per account.
Rate limits
- Reads: stay near or below 40 requests per second on average, with burst capacity to about 100 per second.
- Writes: 5–20 requests per second on average; bulk tag operations are capped at 5 per second.
- Two tiers are enforced at once — a per-second burst limit and a per-minute sustained limit — and exceeding either returns 429.
- Headers: X-RateLimit-Limit, X-RateLimit-Interval (milliseconds) and X-RateLimit-Reset (milliseconds to wait before retrying).
- The upload API is excluded from rate limiting.
Worth knowing
- X-RateLimit-Reset is a number of milliseconds to sleep, not a Unix timestamp. Treating it as epoch seconds turns a 200 ms pause into a very long one.
- Rolling a compromised key lets you choose when the old one dies — immediately, in 1 hour, 24 hours, 3 days or 7 days — and nothing retires it otherwise.
- Five standard plus five restricted keys is the ceiling, so a key-per-agent or key-per-environment scheme runs out quickly.
- Extension units are a second currency on top of requests: background removal costs 10–130 units per call, image generation 65, auto-tagging 1–2, creative automation 50 per variation.
Checked against API overview (2026-09-29), API keys (2026-09-29), Pricing plan parameters (2026-09-29)
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Often connected alongside
Put ImageKit behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.