FastOG SDK — Download & Use

One file per language, zero dependencies, no package manager required. Copy the file into your project (server-side only) or curl it straight from our CDN. Maintained as v1 right here — when the contract changes we update this page and the downloadable files together. For the full signing contract + hand-rolled implementations in any language, see Agent & LLM Integration.

Downloads

Vue, Next.js, Astro and Express run on Node — they share the same tested signer files (CommonJS for Express, ESM for the rest); only the usage/README differs. Each framework's sdk/<name>/README.md shows the exact integration.

Each file is the whole SDK. Copy it into your project, require/import it, done.

Usage

Node.js

const { ogImageUrl } = require("./fastog.js");
const url = ogImageUrl(
    {
        template: "blog",
        title: "Hello World",
        features: ["Free shipping", "30-day returns"],
    },
    { key: process.env.FASTOG_API_KEY, secret: process.env.FASTOG_HMAC_SECRET },
);

SvelteKit (in +page.server.js / +layout.server.js)

import { ogImageUrl } from "$lib/fastog.js";
const url = ogImageUrl(params, {
    key: process.env.FASTOG_API_KEY,
    secret: process.env.FASTOG_HMAC_SECRET,
});

PHP

use FastOg\FastOg;
$url = FastOg::signedUrl($params, getenv('FASTOG_API_KEY'), getenv('FASTOG_HMAC_SECRET'));

Ruby / Rails

url = FastOg.signed_url(params, ENV.fetch("FASTOG_API_KEY"), ENV.fetch("FASTOG_HMAC_SECRET"))

Python (Django / FastAPI / Flask)

import fastog
url = fastog.signed_url(params, os.environ["FASTOG_API_KEY"], os.environ["FASTOG_HMAC_SECRET"])

Go

url := fastog.SignedURL(params, os.Getenv("FASTOG_API_KEY"), os.Getenv("FASTOG_HMAC_SECRET"))

Express / Next.js / Astro / Vue (Node) — import the signer, call ogImageUrl(params, { key, secret }) in your server code, render the URL in the head. See each framework's sdk/<name>/README.md.

Drop url into <meta property="og:image">. Crawlers GET it — edge-cached, one credit per unique image.

Versioning

This is v1 and it's maintained in place. When the contract changes we bump the files + this page together (v2, v3, …) — you update by re-downloading. No package registry to sync, no semver ceremony, no multi-package drift.

How it works

canonical = sorted enc(key)=enc(value) pairs of every param except `s`, including `key`
message   = "GET/api/v1/og" + "\n" + canonical
signature = hex(HMAC-SHA256(message, secret))

• Any change to a param invalidates the signature → 401, no render, no credit.
• Identical params → identical URL → cacheable at the edge forever.
• Array params (features) are emitted as key[]= / key[0]= so the server decodes them correctly.
• Revoke by rotating the key's secret.

Verification

All SDKs are tested against the same golden vector produced by the FastOG server:

canonical = features=30-day%20returns&features=Free%20shipping&key=sk_test123&template=blog&title=Hello%20World
signature = a79232b15b45002aee76174f542e0a661b37cb1259df01e263c952ca4052a54d

If your copy produces that signature for those params, the server will accept your URLs.

Security

• secret is server-side only — never in the browser, never in a public CDN script.
• key is public (it appears in URLs) — that's expected.
• Sign on your server; the FastOG URL is what you embed, not the secret.