> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://uploadcare.com/docs/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://uploadcare.com/docs/_mcp/server.

# Securing image files from reverting applied operations

> Uploadcare can protect your images and photos from unauthorized editing.

Uploadcare enables you to safeguard your images and photos from unauthorized
editing and misuse.

When you apply our on-the-fly [image processing operations](/docs/transformations/image/#image-transformations-list)
(e.g. crop, blur faces or add a watermark), you do so by modifying its URL.
Unfortunately, some users can remove those parameters and regain access to the original image.

You can "bake" a URL with operations applied to an image by saving a processed
image version as a separate file. There are 3 ways to do this.

To prevent this, you can "bake" a URL with the operations applied to an image
by saving a processed image version as a separate file or by signing existing URLs.
There are three ways to do this.

## Signed URLs

The best way to protect URLs from modification is to use [signed URLs](/docs/security/secure-delivery/).
Just set the very long validity period (e.g., several years).

This method doesn't affect your *storage volume* and *upload units*.
You can monitor usage in the project's [Dashboard](https://app.uploadcare.com/).

## Re-upload a new version

Use Upload API `from_URL` method:

```bash
curl -L -X POST 'https://upload.uploadcare.com/from_url/' \
     -F "pub_key=$YOUR_PUBLIC_KEY" \
     -F "source_url=https://$SUBDOMAIN.ucarecd.net/$UUID/-/operation/:param/"
```

Where:

* `$YOUR_PUBLIC_KEY`: get from [API keys](https://app.uploadcare.com/projects/-/api-keys/).
* `$SUBDOMAIN`: your project's subdomain. Find it in [Delivery](https://app.uploadcare.com/projects/-/settings/#delivery).
* `$UUID`: UUID of original image.
* `-/operation/:param/`: the name of the [image processing `operation`](/docs/transformations/image/#image-transformations-list)
  with `parameters` (if necessary), that you want to bake in.

The response will contain a [token](https://uploadcare.com/docs/api/upload/upload/from-url-upload):

```
{
"type": "token",
"token": "945ebb27-1fd6-46c6-a859-b9893712d650"
}
```

The actual file UUID should be retrieved by calling the `/from_url/status/` endpoint.

## Create a copy \[#copy]

Use REST API [`local_copy`](https://uploadcare.com/docs/api/rest/file/create-local-copy) operation:

```bash
curl -L -X POST 'https://api.uploadcare.com/files/local_copy/' \
     -H "Accept: application/vnd.uploadcare-v0.7+json" \
     -H "Authorization: Uploadcare.Simple $YOUR_PUBLIC_KEY:$YOUR_SECRET_KEY" \
     -F "source=$UUID/-/operation/:param/"
```

Where:

* `$YOUR_PUBLIC_KEY` and `$YOUR_SECRET_KEY`: get them from [API keys](https://app.uploadcare.com/projects/-/api-keys/).
* `$UUID`: UUID of original image.
* `-/{operation}/{param}/`: [image processing operations](/docs/transformations/image/#image-transformations-list)
  that you need to bake in.

As a result, the processed version will be saved in the same project
as a separate file, which you can safely use in your application.
The URL has changed; it only contains a newly assigned UUID;
no operations are present.

## API integrations

You don't have to code most of the low-level API integrations.
We have high-level libraries for all popular platforms:

* [JavaScript](/docs/integrations/javascript/)
* [PHP](/docs/integrations/php/)
* [Python & Django](/docs/integrations/python/)
* [Ruby](/docs/integrations/ruby/)
* [Rails](/docs/integrations/rails/)
* [Java](/docs/integrations/java/)
* [Golang](/docs/integrations/golang/)
* [Rust](/docs/integrations/rust/)
* [Swift](/docs/integrations/swift/)
* [Android](/docs/integrations/android/)

Copying via `from_url` can be safely done on the front end using
client-side [JS libraries](/docs/integrations/#wrappers).