HEIC conversion API (not available)

Quickstart

1. If the API launches, you would get a key that looks like hk_live_…, shown to you exactly once. No keys are being issued today; tell us through the feedback form if you would use one.
2. Export it: export HEIC_TO_API_KEY=hk_live_…
3. Send a multipart request with the file:

curl -X POST https://heic-to.io/api/v1/convert \
  -H "Authorization: Bearer $HEIC_TO_API_KEY" \
  -F "file=@IMG_0001.HEIC" \
  -F "format=jpg" \
  -F "quality=85" \
  -F "max_edge=2048" \
  -o IMG_0001.jpg

Authentication

Requests would send a key as a Bearer token: Authorization: Bearer hk_live_…. Only a SHA-256 hash of a key would be stored, so a lost key could not be recovered and would be replaced. Keys would belong on your server, never in a browser or app bundle.

Planned base URL: https://heic-to.io/api/v1, HTTPS only. It returns 404 today.

POST/api/v1/convert

Body: multipart/form-data. On success the response body would be the converted file (status 200). Each successful conversion would use one unit of a monthly quota; failed requests would not.

Response headers

Content-Type

MIME type of the output, e.g. image/jpeg or application/pdf.

Content-Disposition

attachment; filename="<original name>.<ext>"

X-Image-Width / X-Image-Height

Pixel size of the output image.

X-Image-Count

Number of top-level images in the source file.

RateLimit-Limit / -Remaining / -Reset

Per-minute window (IETF draft names).

X-Quota-Remaining

Conversions left this calendar month (UTC).

X-Request-Id

Quote this when contacting support.

WebP with metadata, saving headers

curl -X POST https://heic-to.io/api/v1/convert \
  -H "Authorization: Bearer $HEIC_TO_API_KEY" \
  -F "file=@photo.heic" -F "format=webp" -F "keep_metadata=true" \
  --fail-with-body -D headers.txt -o photo.webp

GET/api/v1/usage

Would report a key’s plan, the current rate-limit window and the month’s quota, counting towards the per-minute limit but not the monthly quota.

curl https://heic-to.io/api/v1/usage \
  -H "Authorization: Bearer $HEIC_TO_API_KEY"

{
  "plan": "free",
  "key_prefix": "hk_live_3fA9kQ2z",
  "rate_limit": { "per_minute": 10, "remaining": 9, "reset_seconds": 42 },
  "quota": {
    "month": "2026-09",
    "limit": 100,
    "used": 17,
    "remaining": 83,
    "resets_at": "2026-10-01T00:00:00.000Z"
  }
}

Errors

Every error would have the same JSON shape, so you could branch on error.code and show error.message to humans.

{
  "error": {
    "code": "quota_exceeded",
    "message": "Monthly quota of 100 conversions used up; it resets at 2026-10-01T00:00:00.000Z."
  }
}

Planned limits

• Max file size 50 MB; max image size 50 megapixels; 30 s per conversion.
• Quotas would reset at 00:00 UTC on the first day of each month.
• On 429 or 503, clients would wait for the Retry-After seconds before retrying.
• CORS would be open (no cookies), but keys would belong on your server, not in browsers.

Planned data handling

• ✓ Uploaded images would live only in server memory for the duration of the request, and would not be written to disk, cached, logged or used for anything else.
• ✓ Only request metadata would be logged: client ID, key prefix, output format, byte sizes, duration, status and, when a request fails, an error code or message — never file names, pixels or EXIF.
• ✓ Metadata (including GPS location) would be stripped from output unless you send keep_metadata=true.

See the privacy policy for details.