Kilo Docs

Docs / Security/ Allowed image hosts

Allowed image hosts

Updated Aug 9, 2026

Package photos on the API are not base64 in the JSON.

You send HTTPS URLs. Kilo:

  1. Checks the hostname is on your allowlist.
  2. Resolves DNS and blocks private IPs (SSRF protection).
  3. Downloads the image (size + content-type limits).
  4. Stores it on the delivery like the public form would.

Configure

Dashboard → Settings → API & Webhooks → Allowed image hosts.

One hostname per line, for example:

cdn.yourbot.com
media.yourcompany.com

Subdomains of an allowed host are accepted (a.cdn.yourbot.com if cdn.yourbot.com is listed).

Checklist for AI / WhatsApp bots

  1. Host media on a domain you control (or a known CDN).
  2. Add that domain to the allowlist before creating deliveries.
  3. Use https:// only.
  4. Keep each image under 5MB.
← WebhooksAPI reference →