Caching and browser delivery

API responses are private and no-store, varying by X-API-Key. Keep them out of shared application caches. Ready underlying bytes may be shared at the delivery layer, but authorization must run for each viewer request, including warm-cache requests.

Use a <picture> element with the returned AVIF and WebP URLs:

<picture>
  <source type="image/avif" srcset="RETURNED_AVIF_URL" />
  <img
    src="RETURNED_WEBP_URL"
    width="128"
    height="128"
    alt="Item thumbnail"
    loading="lazy"
  />
</picture>

Replace width and height with the returned dimensions and choose meaningful alt text for your UI. These placeholders are not executable URLs. The browser chooses a supported format; Images does not rewrite the URL based on Accept.

Honor response cache headers. Do not add an application service-worker cache that bypasses revocation. A browser may already hold decoded image pixels; revocation prevents subsequent authorized delivery, not erasure of bytes already received. Show a fallback if loading fails and do not loop between failed URLs indefinitely.

Ordinary <img> display is distinct from JavaScript fetch/canvas access. Do not assume a cross-origin readable canvas or credentialed CORS contract. Never send an API Credential to the CDN. GET, HEAD, conditional and range requests must all pass delivery authorization before cache/object lookup.