Upload an image to Cloudflare Images by direct API upload or direct creator upload URL, and serve it via named or flexible variants

Documented steps

1. Create an account-scoped API token with 'Cloudflare Images: Edit' ('Images Write').
2. Direct API upload: POST https://api.cloudflare.com/client/v4/accounts/{account_id}/images/v1 as multipart/form-data with `Authorization: Bearer <API_TOKEN>`. Supply either `file` (binary) or `url` (string for Cloudflare to fetch) — they are mutually exclusive — plus optional `requireSignedURLs`, `metadata` and a custom `id`.
3. Read the envelope {"success":true,"result":{"id","filename","uploaded","requireSignedURLs","variants":[...],"metadata"},"errors":[],"messages":[]}.
4. Direct creator upload (server side): POST https://api.cloudflare.com/client/v4/accounts/{account_id}/images/v2/direct_upload as multipart/form-data with `Authorization: Bearer <API_TOKEN>` and optional `requireSignedURLs`, `metadata`, `id`, `expiry` (ISO 8601).
5. Return only result.uploadURL to the untrusted client and keep result.id server side. Never hand the API token to a browser or mobile app.
6. Client side: the browser performs an unauthenticated multipart POST with a `file` field directly to that uploadURL. The URL is single-use.
7. Create a named variant: POST https://api.cloudflare.com/client/v4/accounts/{account_id}/images/v1/variants with `Content-Type: application/json` and body {"id":"<variant-name>","options":{"fit":"scale-down|contain|cover|crop|pad","width":<px>,"height":<px>,"metadata":"none|keep|copyright"},"neverRequireSignedURLs":<bool>}.
8. Serve through the variant at https://imagedelivery.net/<ACCOUNT_HASH>/<IMAGE_ID>/<VARIANT_NAME>.
9. Alternatively enable on-the-fly sizing: PATCH https://api.cloudflare.com/client/v4/accounts/{account_id}/images/v1/config with {"flexible_variants": true}, then request URLs like https://imagedelivery.net/<ACCOUNT_HASH>/<IMAGE_ID>/w=400,sharpen=3.
10. For private images set requireSignedURLs true at upload, then generate signed URLs server side by appending `exp` (Unix expiry) and `sig` (HMAC-SHA256 over path+exp using the Images signing key). Never ship the signing key to a client. Docs: https://developers.cloudflare.com/images/storage/upload-images/direct-creator-upload/ , https://developers.cloudflare.com/api/resources/images/subresources/v1/methods/create/ , https://developers.cloudflare.com/images/manage-images/create-variants/ , https://developers.cloudflare.com/images/manage-images/enable-flexible-variants/