# HMAC SHA-256 Generator

Generate a token for an HTML/CSS to Image signed URL.

Your API key and query string stay in this browser tab. Nothing is transmitted, logged, or stored.

Query string

Enter the exact encoded query string after `?`. A leading `?` is ignored. Parameter order, encoding, whitespace, and repeated values matter.

API Key

HMAC SHA-256 token

Use the token in the path of your [create-and-render URL](/getting-started/create-and-render/#creating-an-image). Keep your API key secret; only the generated token belongs in the signed URL.

The signing key must be enabled and grant [`images:create`](/getting-started/using-the-api/permissions/). See [API key management](/management-api/api-keys/) when replacing or disabling signing credentials.