Your Cloudinary cloud name and API key appear in URLs and are not secret, but the API secret signs uploads and admin calls and must stay server-side. Prefer signed uploads generated by your server over open unsigned presets.
Identify your account in delivery URLs and signed requests.
Signs upload and Admin API requests.
Sign only the parameters you allow, such as folder and resource type, with a short timestamp window.
Limit formats, file size, and folder, and apply moderation.
Attackers can upload, overwrite, or delete any asset in your account.
Anyone can use your storage and bandwidth quota to host arbitrary files.
Store CLOUDINARY_API_SECRET in the vault and expose a signing or Admin API pipeline that returns only the fields the uploader needs.
Only with a tightly restricted preset. Signed uploads are safer because your server controls every parameter.
You should not store Cloudinary credentials in Vue / SPA client code. Upload and transform URLs signed at the edge with API secret in Vault. RealComposer Secret Vault injects headers on Cloudflare Workers so only your edge URL is public.
To merge cloudinary assets with contentful entries, use one RealComposer pipeline with parallel steps. Resolve Contentful asset references with Cloudinary transformation metadata. Your Next.js / React app makes one request instead of several sequential upstream calls.
You should not store Cloudinary credentials in Framer client code. Framer components hit RealComposer for signed upload parameters. RealComposer Secret Vault injects headers on Cloudflare Workers so only your edge URL is public.
To merge cloudinary with shopify product images, use one RealComposer pipeline with parallel steps. Shopify product media plus Cloudinary derived URLs in one feed. Your React app makes one request instead of several sequential upstream calls.
To cache cloudinary transformation api at edge, put a TTL cache on your RealComposer pipeline. Cache transformation metadata responses per public_id. Shared edge cache absorbs repeat traffic before it reaches Cloudinary.
React Native apps hit CORS and credential limits when calling Cloudinary. Sign Cloudinary uploads at the edge instead of shipping API secrets in the app bundle. Use one RealComposer edge URL with OPTIONS handling, client tokens, and vault injection.
HMAC authentication uses a hash-based message authentication code, computed from a message and a shared secret key, to prove that a request came from a holder of the secret and was not modified. The receiver recomputes the HMAC and compares it to the value sent.
API AbuseAPI abuse is the misuse of an API in ways it was not intended, such as using leaked keys, scraping data at scale, exhausting quotas, or automating fraudulent actions. Abuse can cause large unexpected bills, data theft, and service degradation for legitimate users.
Content Delivery Network (CDN)A Content Delivery Network (CDN) is a globally distributed network of servers that caches and serves content from locations close to users. By answering requests from a nearby point of presence instead of a distant origin, a CDN reduces latency, offloads origin traffic, and absorbs traffic spikes.