Delivery

Last updated: August 21st 2026

delivery.generateBeforePageLoad controls whether missing derivatives are built during the template request or deferred to a signed URL.

'delivery' => [
    'generateBeforePageLoad' => true,
    'thumbnail' => [
        'enabled' => true,
        'width' => 32,
        'format' => 'jpg',
        'quality' => 50,
        'variant' => 'thumb',
    ],
],
SettingMissing fileURL in HTML
trueGenerated during the page requestStorage/CDN URL
falseGenerated when the browser hits the actionSigned Super Images generate action URL

If the file already exists, tags always emit the storage URL.

Runtime endpoint

Used when generateBeforePageLoad is false:
'runtime' => [
    'enabled' => true,
    'signingSecret' => $_ENV['SUPER_IMAGES_SIGNING_KEY'] ?? null,
    'urlTtl' => 3600,
    'maxWidth' => 4096,
    'maxHeight' => 4096,
    'maxPixels' => 20_000_000,
],

If signingSecret is empty, ExpressionEngine’s encryption key is used when available. Set an explicit secret in production.

Flow when deferred:
Tag emits signed URL
        ↓
Browser requests the Super Images generate action
        ↓
Verify signature → generate → 302 → storage URL

If runtime.enabled is false and generateBeforePageLoad is also false, Super Images still sync-generates so templates do not 404.

Runtime caps apply to requested dimensions, not source size. Source pixels are limited by policies.safety.maxSourcePixels.

Thumbnails

picture can put a tiny derivative in <img src> while full candidates stay in <source> / srcset. Configure delivery.thumbnail.

Locks

Generation locking prevents stampedes when many clients request the same missing derivative at once.

Security notes

  • Do not put secrets in identity hashes, markers, or template output.
  • Runtime limits reject oversized geometry requests.
  • Local/remote sources still require allow-lists.
  • The generate action is GET-signed for <img> tags; keep the signing secret private.