
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
strapi-plugin-imagekit
Advanced tools
A Strapi plugin that provides seamless integration with ImageKit.io, enabling you to browse, manage, and deliver optimized media directly from your Strapi admin panel. View the plugin installation and setup video here.
ImageKit is a complete media storage, optimization, and transformation solution with an image and video CDN. It integrates with your existing infrastructure (AWS S3, web servers, CDN, custom domains) to deliver optimized images in minutes with minimal code changes.
Before you begin, you need:
You can refer to Strapi's official documentation to understand the prerequisites for running your Strapi instance.
To install the ImageKit plugin in your Strapi instance, run one of the following commands from your project's root directory:
# Using NPM
npm install strapi-plugin-imagekit --save
# Using Yarn (recommended)
yarn add strapi-plugin-imagekit
Once installed, you must rebuild your Strapi instance:
# Using NPM
npm run build
npm run develop
# Using Yarn
yarn build
yarn develop
# OR development mode with auto-reload for admin panel
yarn develop --watch-admin
The ImageKit plugin will appear in the sidebar and Settings section after the app rebuilds.
![]() | ![]() |
You can configure the ImageKit plugin from within the Strapi admin dashboard. Follow these steps:

You'll see three configuration sections that you should complete in order:
This section contains the essential credentials to connect with your ImageKit account:
public_) from the API Keys section of your ImageKit dashboard.private_) from the same dashboard page. Note: Keep your private key confidential as it grants full access to your ImageKit account.https://ik.imagekit.io/your_imagekit_id) from the same dashboard page.
After adding your credentials, set up how your media will be served:
Decide how uploads should work:
/strapi-uploads/)strapi,media)Click the Save button in the top-right corner to apply your settings.
Note: Some changes may require restarting your Strapi server to take full effect.
While the primary way to configure the ImageKit plugin is through the Strapi admin settings page, you can also provide default values in your Strapi project's configuration file. This is particularly useful for setting up initial configurations in development or deployment environments.
Settings defined in config/plugins.js serve as default values that are copied to the dashboard on the first run of your Strapi application. After this initial setup, any changes made through the admin UI will be stored in the database and will be used instead of the values in the configuration file.
Follow these steps:
config/plugins.js file with ImageKit configuration:module.exports = ({ env }) => ({
imagekit: {
enabled: true,
config: {
// Basic Configuration
publicKey: env('IMAGEKIT_PUBLIC_KEY'),
privateKey: env('IMAGEKIT_PRIVATE_KEY'),
urlEndpoint: env('IMAGEKIT_URL_ENDPOINT'),
// Delivery Configuration
enabled: true,
useTransformUrls: true,
useSignedUrls: false,
expiry: 3600, // URL expiry time in seconds when useSignedUrls is true
// Upload Configuration
uploadEnabled: true,
// Upload Options
uploadOptions: {
folder: '/strapi-uploads/',
tags: ['strapi', 'media'],
overwriteTags: false,
checks: '', // Example: '"file.size" <= "5MB"'
isPrivateFile: false,
},
},
},
});
.env file:IMAGEKIT_PUBLIC_KEY=your_public_key_here
IMAGEKIT_PRIVATE_KEY=your_private_key_here
IMAGEKIT_URL_ENDPOINT=https://ik.imagekit.io/your_imagekit_id
You can, of course, add more environment variables if you choose to configure other optional settings (like IMAGEKIT_UPLOAD_FOLDER, IMAGEKIT_USE_SIGNED_URLS, etc.) through env() calls in your config/plugins.js.
yarn develop
To ensure your Strapi application can securely load assets and interact with ImageKit services, you need to update your Content Security Policy (CSP) settings. This is configured in the strapi::security middleware.
Modify your config/middlewares.js file as follows. This configuration allows your Strapi admin panel and frontend (if applicable) to load images, videos, and potentially embeddable ImageKit frames, while maintaining a secure policy:
// config/middlewares.js
module.exports = [
{
name: 'strapi::security',
config: {
contentSecurityPolicy: {
useDefaults: true,
directives: {
'connect-src': ["'self'", 'https:'],
'img-src': [
"'self'",
'data:',
'blob:',
'ik.imagekit.io', // Add ImageKit domain for images
// Add your custom domain if you use one with ImageKit:
// 'images.yourdomain.com',
],
'media-src': [
"'self'",
'data:',
'blob:',
'ik.imagekit.io', // Add ImageKit domain for videos/audio
// Add your custom domain if you use one:
// 'media.yourdomain.com',
],
'frame-src': [
"'self'",
'data:',
'blob:',
'eml.imagekit.io', // For ImageKit UI components
],
upgradeInsecureRequests: null,
},
},
},
},
// Keep your other middleware entries here
];
Important: If you use a custom domain with ImageKit, uncomment and update the relevant lines with your domain.
Contributions are welcome! Please read our contributing guidelines before submitting pull requests.
This project is licensed under the MIT License - see the LICENSE file for details.
For support, please contact ImageKit Support or open an issue in the GitHub repository.
FAQs
[](https://imagekit.io)
The npm package strapi-plugin-imagekit receives a total of 37 weekly downloads. As such, strapi-plugin-imagekit popularity was classified as not popular.
We found that strapi-plugin-imagekit demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.