Imagera Hermes Spicy — From Image API

# Put the key in your environment, never in source control.
export IMAGERA_API_KEY="ima_sk_YOUR_KEY"

const response = await fetch(
  "https://api.imagera.ai/v1/queue/imagera-video-hermes-spicy-from-image",
  {
    method: "POST",
    headers: {
      "Authorization": `Key ${process.env.IMAGERA_API_KEY}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      "image_urls": [
        "https://example.com/input.jpg"
      ]
    }),
  },
);

// 202 Accepted — the job is queued, not finished.
const job = await response.json();
console.log(job.request_id, job.status);

Authorization: Key ima_sk_YOUR_KEY

{
  "event_id": "evt_7c1f9a3e5b2d4086a1c3e5f7b9d0",
  "event_type": "generation.completed",
  "api_version": "2026-07-31",
  "created_at": "2026-07-31T08:42:17.000Z",
  "request_id": "req_8f3c1a9e2b7d",
  "status": "OK",
  "data": {
    "request_id": "req_8f3c1a9e2b7d",
    "gateway_request_id": "req_8f3c1a9e2b7d",
    "status": "COMPLETED",
    "model": "imagera-video-hermes-spicy-from-image",
    "credits_used": 45,
    "timings": {
      "inference_seconds": 4.2
    },
    "videos": [
      {
        "url": "https://example.com/output.mp4",
        "file_name": "output.mp4",
        "content_type": "video/mp4"
      }
    ],
    "output_count": 1
  },
  "error": null
}

const crypto = require("node:crypto");

function verifyImageraWebhook(rawBody, headers, secrets, toleranceSeconds = 300) {
  const eventId   = headers["imagera-webhook-id"];
  const timestamp = headers["imagera-webhook-timestamp"];
  const header    = headers["imagera-webhook-signature"];
  if (!eventId || !timestamp || !header) return false;

  // Replay bound. Without it a captured request is valid forever.
  if (Math.abs(Math.floor(Date.now() / 1000) - Number(timestamp)) > toleranceSeconds) return false;

  const bodyHash     = crypto.createHash("sha256").update(rawBody).digest("hex");
  const signedString = `v1\n${eventId}\n${timestamp}\n${bodyHash}`;

  // The header may carry SEVERAL signatures during a secret rotation.
  const candidates = header.split(/\s+/)
    .filter((p) => p.startsWith("v1="))
    .map((p) => Buffer.from(p.slice(3), "hex"));

  return [].concat(secrets).some((secret) => {
    const expected = crypto.createHmac("sha256", secret).update(signedString).digest();
    return candidates.some(
      (c) => c.length === expected.length && crypto.timingSafeEqual(c, expected),
    );
  });
}

// Express — note express.raw(), NOT express.json().
app.post("/imagera", express.raw({ type: "application/json" }), (req, res) => {
  if (!verifyImageraWebhook(req.body, req.headers, [process.env.IMAGERA_WEBHOOK_SECRET])) {
    return res.status(401).send("bad signature");
  }
  const event = JSON.parse(req.body.toString("utf8"));
  // Dedupe on event.event_id, then acknowledge fast.
  res.status(200).send("ok");
});

{
  "request_id": "req_8f3c1a9e2b7d",
  "status": "IN_QUEUE",
  "model": "imagera-video-hermes-spicy-from-image",
  "status_url": "https://api.imagera.ai/v1/queue/requests/req_8f3c1a9e2b7d/status",
  "response_url": "https://api.imagera.ai/v1/queue/requests/req_8f3c1a9e2b7d",
  "cancel_url": "https://api.imagera.ai/v1/queue/requests/req_8f3c1a9e2b7d/cancel"
}

// Prefer the status_url the submit response gave you.
const res = await fetch(job.status_url, {
  headers: { "Authorization": `Key ${process.env.IMAGERA_API_KEY}` },
});
const { status } = await res.json();

const res = await fetch(job.response_url, {
  headers: { "Authorization": `Key ${process.env.IMAGERA_API_KEY}` },
});
const result = await res.json();

import { readFile } from "node:fs/promises";

const bytes = await readFile("./input.jpg");
const dataUri = `data:image/jpeg;base64,${bytes.toString("base64")}`;

// Pass it anywhere the schema expects a URI.
body: JSON.stringify({ image_urls: [dataUri] })

body: JSON.stringify({"image_urls":["https://example.com/input.jpg"]})