# Chat images and GIFs

> Current status reviewed September 29, 2026. See [the release index](README.md) for shipped versus planned features, network, wallet signing and deployment boundaries. Older dated experiments below are retained as history.

Image attachments open in the internal viewer, with fit-to-screen, original size, closing via Esc/click outside and focus return to the origin button. The external link and the download are separate actions. Animated images use the original file served by the attachments endpoint, preserving the animation.

## KLIPY

Configure `KLIPY_API_KEY` in the runtime environment (Vercel Production and `.env.local` in development). Run `npm run db:migrate` to apply `0011_chat_gifs.sql`. The Vercel deployment already runs the migrations before the build.

The GIF button opens trending and searches via Enter/magnifier, with pagination. Selecting a result prepares a preview; the Send button publishes the GIF along with the caption. Local upload of GIF files remains available in the picker.

The key is a public identifier of the integration: `/api/gifs?room=...` delivers it to authenticated users with permission to send attachments in the channel. The queries and media are loaded directly from KLIPY, per its [integration rules](https://docs.klipy.com/integration-requirements). The key does not go into the static bundle, but it is visible in client requests. Do not use an account administration credential in this field.

The URLs returned by the provider are preserved and stored as a reference in the message; no KLIPY file is copied to the database. The server validates the CDN HTTPS domain, the image format and the channel permissions. Removing the message also removes the reference to the GIF. Failures in the share registration do not undo delivered messages.

The test key has a limit of 100 queries per hour. To expand the quota, request production access in the KLIPY dashboard after validating the integration; the approval is the provider's. The queries require available network and access to the `api.klipy.com` domain and to the `static*.klipy.com`/`static*.klipy.co` CDNs.