How to get a public URL for an image an API can fetch

To get a public URL for an image, put the file somewhere that serves it over HTTPS to anyone, without a login: an object in a cloud storage bucket that you make public, a public bucket address, or a folder on your own website. Then open the URL from a browser or machine that isn't signed in to anything: if the image loads there, the URL is public.

Storage behavior below is quoted from Google Cloud's Make data public and Access public data, Amazon S3's Block Public Access and presigned URL guides, and Cloudflare's R2 public buckets page; the Sume rules come from its API reference and Media inputs docs. All were read on 2026-09-28.

Where can I host an image to get a public URL?

Any HTTPS host that answers without asking who you are. The common options, and the catch with each:

How do I check that an image URL is really public?

Fetch it the way an API server would: from outside your network, with no cookies or credentials. A request for the headers alone is enough. You want a 200 status and a Content-Type that starts with image/; a redirect to a login page, a 403, or an HTML page means the server won't get the image either.

curl -sI https://storage.googleapis.com/BUCKET_NAME/product.png
# HTTP/2 200
# content-type: image/png

Is a public image URL permanent?

Only as long as you leave it public. Google's docs say anyone who knows a public object's URI can access it for as long as the object is public, so don't put anything private there. A presigned URL is the opposite trade: it grants time-limited access, and once it expires the link stops working, which matters if a job fetches the image later than you expect.

What kind of image URL does Sume accept?

A plain public HTTPS URL. Sume's generation requests take fetchable public HTTPS media URLs directly in the documented fields, such as an avatar photo's input.image_url, and reject localhost, private-network, non-HTTPS and non-image responses before the job is submitted (API reference). Its Media inputs page also lists signed or private URLs as rejected, so use a public object rather than a presigned link.

Sume's upload routes are hidden from its public OpenAPI, and the docs say to prefer public HTTPS media URLs, so host the file yourself as above. Sume's editing tools, such as trim and Timeline, work differently: they take files already on this workspace's media.sume.com, as Sume media URL rules by endpoint explains.