Upload to an S3-compatible service

Connect HTML/CSS to Image to an S3-compatible provider that is not listed separately in the dashboard.

Use the Other S3-compatible provider when your object storage service supports the S3 API but does not have a dedicated HCTI option. You supply the service endpoint, signing region, addressing style, and access keys.

You need:

• An existing bucket on an S3-compatible service.
• A public HTTPS S3 API endpoint.
• An access key ID and secret access key.
• The signing region required by the provider, if it uses one.
• The provider’s required bucket addressing style.
• An optional key prefix, such as hcti-renders.

This option is for public cloud object-storage APIs. HCTI cannot connect to a private network endpoint, a local development server, or a hostname that resolves to a private IP address.

Create credentials restricted to the destination bucket and key prefix whenever the service supports it.

Provider permission names may differ, but the allowed object operations should be equivalent. Confirm that a bucket policy, access policy, or firewall rule does not override the credential with an explicit deny.

Enter the provider’s S3 service endpoint, not a bucket URL or public file URL.

The custom endpoint must:

• Start with https://.
• Resolve to public IP addresses.
• Contain no username or password.
• Contain no path, query string, or fragment.

For example, enter https://objects.example-provider.com, not https://objects.example-provider.com/my-bucket.

Choose the addressing style required by your provider:

Use the provider’s S3 integration documentation to determine the signing region and addressing style. A region used for request signing is not always the same as a friendly data-center label.

Open the Storage Destinations dashboard, click Add storage destination, and enter:

Click Test connection, then enable and save the destination after the test succeeds. Copy the destination id for your API requests.

The test writes a small object under <key-prefix>/.hcti/connection-tests/. Cleanup is best-effort, so missing delete access does not make a successful write test fail.

Pass the destination ID as storage_destination_id when you create an image:

curl -X POST https://hcti.io/v1/image \
  -u 'user-id:api-key' \
  -H 'Content-Type: application/json' \
  -d '{
        "url": "https://example.com",
        "storage_destination_id": "your-storage-destination-id"
      }'

Rendering is lazy. With normal HCTI storage enabled, request the returned image URL to render the image and upload the provider copy. With Disable HCTI Storage selected, send an authenticated PUT request to the returned /v1/store/... URL.

The base object is stored as <key-prefix>/<image-id>.png, or .pdf when the request uses pdf_options. The provider’s bucket policy continues to control object access.

• The custom endpoint is rejected — Remove the bucket path, credentials, query string, or fragment. Confirm the endpoint uses HTTPS and public DNS.
• TLS validation fails — Use the provider’s public service hostname with a valid certificate. Self-signed certificates are not supported.
• The connection test returns a signature error — Recheck the access key, secret, signing region, and the provider’s expected clock and signing configuration.
• The bucket is missing from the request — Switch between virtual-hosted and path-style addressing according to the provider’s documentation.
• A later transformation fails with HCTI Storage disabled — Add the provider’s equivalent of GetObject.

If the provider has a dedicated option in HCTI, use that option instead; it preconfigures the endpoint and addressing behavior. See the Amazon S3, Cloudflare R2, Backblaze B2, DigitalOcean Spaces, Wasabi, and Google Cloud Storage guides.

You can also automate configuration through the Storage destinations API or MCP tools.