---
title: "Proxy Asset"
method: GET
path: "/api/assets/proxy"
tags: ["assets"]
---

# Proxy Asset

`GET /api/assets/proxy`

## Request

- Base URL: `https://api.tintin-x.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.tintin-x.com/api/assets/proxy`
- Auth: none declared

Stream an S3 object through the API.

Fallback for clients that cannot reach S3 directly (e.g. China / GFW).
The frontend tries the presigned URL first and falls back to this proxy.

Auth: query-param token preferred (so <img src> works); falls back to
the ``tintin_token`` cookie set by the login endpoints. Gamma
2026-05-22 — prod tryon users without a localStorage token were 401'd
here, which silently broke the painter / adjust canvases.

Do NOT take `db: AsyncSession = Depends(get_db)` here. FastAPI keeps the
dependency context alive for the entire response lifetime, so a slow
streaming client would hold a DB session for many seconds and starve the
pool. We open a short-lived session manually for the auth check, close
it before streaming starts.

## Query parameters

- `key` string, required: S3 object key to stream
- `token` string, nullable: JWT token. Required for plain <img src> requests that cannot carry the SSO cookie (preview / pages.dev domains). Optional for fetch() callers on .tintin-x.com prod custom domains where the ``tintin_token`` cookie covers auth.

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/tintin-x/apis/tintin-api.md) · [All operations](https://skmtc.dev/tintin-x/apis/tintin-api/llms.txt) · [OpenAPI document](https://skmtc.dev/tintin-x/apis/tintin-api/revisions/8839a8d0a66c?raw)