Obsidian plugin: call Sume with requestUrl and embed the image

Use requestUrl instead of fetch. Obsidian's requestUrl reference describes it as making requests without CORS restrictions, and its response has status, json, arrayBuffer and text. That matters here because Sume's API allows browser calls only from Sume's own origins, so a plugin that used fetch from Obsidian's origin would be blocked by the browser's CORS check.

The call itself is the Sume image API: POST https://api.sume.com/v1/images with a bearer key, then data[0].url on a 200.

A command that inserts the image

This is the body of a plugin's onload. It reads the key from the plugin's saved data, calls Sume, downloads the image as bytes, writes it into the vault, and inserts an embed at the cursor.

import { Plugin, requestUrl } from "obsidian";

export default class SumeImage extends Plugin {
  async onload() {
    this.addCommand({
      id: "sume-image",
      name: "Insert Sume image",
      editorCallback: async (editor) => {
        const key = (await this.loadData())?.key;
        if (!key) return;
        const res = await requestUrl({
          url: "https://api.sume.com/v1/images",
          method: "POST",
          headers: { Authorization: `Bearer ${key}`, "Content-Type": "application/json" },
          body: JSON.stringify({ model: "openai/gpt-image-2.5", quality: "low",
            output_format: "png", prompt: editor.getSelection() }),
        });
        if (res.status !== 200) return;
        const file = await requestUrl({ url: res.json.data[0].url });
        const path = `sume-${Date.now()}.png`;
        await this.app.vault.createBinary(path, file.arrayBuffer);
        editor.replaceSelection(`![[${path}]]`);
      },
    });
  }
}

What can go wrong?

A 202 has no data array. The command above returns quietly on any status but 200; a real plugin should show a notice and poll the status_url in the job envelope. The jobs guide lists the terminal statuses as completed, failed and canceled.

Pin output_format to png. A plain PNG opens in any tool that reads your vault, and Sume accepts the value on every catalog model except Recraft V4, which returns WebP only.

Watch the key. loadData stores the key as plain JSON in the vault's plugin folder, so keep that folder out of any public sync or repository. Each call bills the key's workspace, and usage.cost on the 200 response tells you the amount in USD.

For longer runs, add a command that takes the whole note as the prompt and one that asks for n variants. The request accepts n from 1 to 10, with lower ceilings on some models, so read the catalog before you promise ten choices in a menu.

Test the command on a short selection first. The prompt is whatever text you have highlighted, so an empty selection sends an empty prompt, and the API rejects an empty prompt as invalid. A one-line guard that returns when the selection is blank saves a confusing error notice. For a rate-limited vault, add a lock so a double-click on the command cannot start two paid generations.