We've added a Management API for API keys, proxies, storage destinations and OG Image Configs, along with granular permissions for API keys and MCP connections. Most of these operations are also available through MCP, so your coding agent can configure HCTI while it's building your application.
Until now, you could create images and templates through code, but setting up a proxy or connecting a storage bucket meant opening the dashboard. As we've added more ways to generate and deliver images, more of that setup needed an API of its own.
What's Available
You can now create, list, retrieve, update and delete proxies, storage destinations and OG Image Configs through both REST and MCP.
If you're setting up social images for several websites, you can create each site's OG configuration from a script. If your application stores images in your own bucket, it can register that bucket as a storage destination and use the returned ID when creating images. Changes to those settings can live in your deployment process, too.
API keys have their own management endpoints. You can create a key, change its permissions, or disable it when an integration is retired. Key management is available through REST and the dashboard; it isn't exposed to MCP clients.
The Management API uses the same base URL and authentication as our image API. The API guide and MCP tool reference cover the individual operations.
Adding OG Images with a Coding Agent
Our recent OG Image Configs release shows what these new tools make possible. A config connects your website to HCTI so each page gets its own social image. Setting it up involves work on both sides: configuring HCTI and adding image metadata to your site.
An agent could already write the website code and create an HTML template. With the new MCP tools, it can also create the OG configuration that connects them.
You can ask it something like:
Add OG images to this blog using HCTI. Use our fonts and colors, and show the article title and author on each card.
With access to your repository and the relevant MCP permissions, the agent can:
- Read the site's styles and create an HTML template for the card.
- Create an OG Image Config that maps the page's metadata to the template.
- Add the matching image URL to each page through your shared layout.
- Check the rendered image once the page is publicly reachable, then adjust the design if needed.
We've written an Open Graph images skill to guide that process. It covers both templates and page screenshots, checks for existing resources, and includes verification of the image and the site's metadata.
It also gives the agent a way to handle follow-up changes. If you want a different layout next week, it can update the existing template and check the result. You don't have to start over or copy settings between the dashboard and your chat.
Separate Permissions for Each Integration
Being able to configure more of your account also means being more specific about who can change what.
API keys now have granular permissions. A service that generates images can have access to image creation. A deployment script can have permission to update OG configurations. A monitoring tool can read usage without being able to change anything.
Every new organization still gets a key for everyday image, template and usage operations. Keys created before granular permissions retain that default access unless you edit them. You can expand or reduce a key's permissions, or create separate keys for separate applications.
The dashboard starts with a simple Read/Write view, grouped by area.
You can switch to Advanced mode to select individual actions, including allowing updates without allowing deletion.
Expand an area to see what its permissions allow, down to the endpoints they apply to. Here are the details for OG Image Configs:
The API key guide covers presets and permission settings.
The Automatically grant future permissions option (all_future_permissions) gives a key all current permissions and automatically includes new ones. It's off by default. Giving a key every permission available today doesn't opt it into future permissions.
MCP connections have their own permission approval when you connect an assistant. If you're already connected, you'll need to authorize the additional management permissions to use the new tools. See MCP permissions for the details.
Rate Limits for Management Operations
There is still no rate limit for creating or rendering images. Just your plan's image quota.
The new management operations have limits of 100 reads and 20 writes per minute, per organization and resource type. API keys, proxies, storage destinations and OG Image Configs each have separate allowances. REST and MCP share those limits across all credentials for the organization.
These limits apply when configuring resources. Rendering images with an existing proxy, storage destination or OG configuration doesn't use a management request. The rate-limit guide covers retry behavior. If you need higher management limits, email us.
You can start with the Management API docs or connect HCTI to your coding assistant. We'd love to hear what you're building, and which dashboard tasks you'd like to automate next.