Everything is one REST API at https://snapwonders.com/api. Your very first call
needs no key and no upload — just confirm the service is up:
# Health check — no key required. Returns {"status":"UP", ...}
curl https://snapwonders.com/api/status
Then make your first authenticated call — creating a hide session. A working key returns an
upload_uid; a 401 tells you exactly what to fix (see the next step):
Prefer to skip the raw HTTP? Jump to the SDKs —
they wrap the whole flow (including file upload) into a single call.
2 Get your API key
Create a key on your account, then send it as the X-Api-Key header on every
request. Keys start with sw_ — send the whole key.
Create an account, then click the activation link we email you. Keys
created on an unverified account are rejected by the API — this is the most common
reason a brand-new key returns 401.
Header on every authenticated call: X-Api-Key: sw_your_key_here
Health and the get-started/discovery calls need no key.
If a call returns 401, the error code tells you exactly what is
wrong, so you are never guessing:
missing_api_key — no X-Api-Key header was sent.
malformed_api_key — a header is present but not a valid key shape.
invalid_api_key — a well-formed key that is not recognised, revoked, or expired.
account_not_verified — your key is fine. The account that owns
it has not verified its email address. Click the activation link, then retry with the
same key. Generating a new one will fail in exactly the same way.
account_inactive — your key is fine, but the account cannot use the API.
3 The APIs
Three products share one session → job → poll → download shape. Files upload
over plain HTTP — one request per file — then you start a job and poll it to
completion.
Steganography — hide & reveal
Conceal an encrypted file inside a cover image or video, and reveal it again with the
passphrase. Lossless output.
Forensic analysis
Deep media inspection — manipulation, AI-generation evidence, hidden content, faces, OCR text, watermarks, and
C2PA provenance — graded per file.
Media conversion
Convert between image and video formats (AVIF, HEIC, JXL, WebP, PNG, MP4, MKV, …) with
quality and resize controls.
Full reference
Every endpoint, parameter, and response is in the interactive
Swagger UI, with the raw
OpenAPI spec.
Two upload methods.Direct is one
POST /api/upload per file — the file as the request body, plain headers,
no protocol to implement. Use it for anything under the size limit.
Resumable (TUS, /api/tus) is for large files, unreliable
connections, and progress reporting — it is what this site and the mobile apps use.
File bytes never travel inside an MCP tool call, so an agent orchestrates over MCP and
sends the file with that one HTTP request. The SDKs pick the right method for you —
see SDKs below.
4 MCP — for AI agents
The same capabilities are exposed as tools over the Model Context Protocol,
so an AI agent (Claude, Cursor, VS Code Copilot, and others) can call them directly. Transport
is Streamable HTTP, spec 2025-03-26.
Endpoint: https://snapwonders.com/mcp
Auth: the same X-Api-Key header (three discovery tools — status,
vaultify_get_started, snapwonders_get_started — need no key).
For example, adding it to Claude Code is one line:
claude mcp add --transport http snapwonders https://snapwonders.com/mcp --header "X-Api-Key: sw_your_key_here"
That is just one client. Ready-to-paste config for Claude Desktop, Cursor,
Windsurf, VS Code, and Gemini CLI — plus the full list of MCP tools — is in the
MCP section of the Swagger UI.
Note: MCP is clearnet-only — AI clients cannot reach the Tor or I2P addresses.
Working on files on your own machine
The endpoint above is a remote server, which means it cannot see your files — you
upload them first, then point the agent at the session. If you would rather say "analyse
~/Downloads/photo.jpg" and have it just work, there is also a local MCP server:
it runs on your own machine, so it can read the file, upload it, run the job and save the results
back to disk in one step.
pip install snapwonders-mcp
It needs uv and an
API key. For Claude Desktop, add this to your MCP configuration:
Four tools — analyse_file, hide_file, reveal_file and
convert_file — each doing a whole task end to end. Source, full configuration and the
security notes are in the
GitHub repository.
The processing still happens on snapWONDERS servers — "local" means the server
process runs on your machine so it can read your disk, not that analysis runs offline. The server
acts only on paths supplied with each request and has no tool to list or search your filesystem,
but it can read any file you can, so your MCP client's tool-approval prompt is the real gate.
5 SDKs
Official client libraries wrap the API — including picking the right upload method and
handling resumable transfers — into one idiomatic call, so a whole hide job is a couple of
lines, in Python, JavaScript/TypeScript, PHP, or Go.
Python — snapwonders
# pip install snapwondersfrom snapwonders import Client
client = Client(api_key="sw_...")
job = client.stego.hide(
["secret.pdf", "cover.jpg"], password="Str0ng!Pass")
for r in job.results(): r.download("out/")
// go get github.com/snapWONDERS/snapWONDERS-SDK-Go
client := snapwonders.NewClient("sw_...")
job, _ := client.Stego.Hide(
[]string{"secret.pdf", "cover.jpg"}, "Str0ng!Pass")
for _, r := range must(job.Results()) { r.Download("out/") }
All four SDKs are live. Python and JavaScript on PyPI and npm,
PHP on Packagist, Go straight from GitHub with go get. All four are open source on GitHub —
Python,
JavaScript/TypeScript,
PHP,
and Go
— install with pip install snapwonders, npm i @snapwonders/sdk,
composer require snapwonders/sdk, or go get. Questions or early-access notes?
Get in touch.
6 Other languages — generate a client
No SDK for your language yet? The API ships a full OpenAPI 3 spec, so you can
generate a typed client for Ruby, Java, C#, Kotlin, Swift, Rust, and dozens more with
OpenAPI Generator:
A generated client covers the plain JSON endpoints. For file upload, point
it at POST /api/upload — one request with the file as the body, which any HTTP
client can already do. Only files above the size limit need the resumable
TUS flow (POST /api/tus → chunked PATCH), which a
generated client cannot express; that is why the official SDKs are hand-written. Both
methods are documented in the
Swagger UI, and you can port the
uploader from any official SDK.
Get updates on new snapWONDERS features, privacy tools, and dark web access improvements — including Vaultify. Nothing else, and you can unsubscribe any time.
