Credentials in the vault
A token requested on demand through the server-to-server flow, renewed before it expires, never pasted into a file or written to a log.
Deliverable: obter_token.sh and a secret-handling ruleOcto for the Photoshop API in the cloud
Eight hundred photos cut out without opening Photoshop. The one who releases the catalog is you.
The Photoshop API, part of Firefly Services, runs background removal, masks, recorded actions and composites on Adobe's servers, called over HTTP. Octo writes the controller that sends the batch without exceeding your organization's limit, keeps the secret in the vault and checks every returned image by content. The contract, the rights to the photo and the approval stay with people.
v1 end of lifeJul 31, 2026v2 changes routes, fields and domain
Soft POST limit300/minoverall, per organization; about 40/min for background removal, according to the technical notes
File size in v2up to 5 GBversus 2 GB in v1
Sources12listed at the end of the page
01
What Octo does with the Photoshop API.
Six possible deliverables, drawn from the research. None of them keeps secrets outside the vault, all of them check the returned image, and all of them go to review by whoever answers for the catalog.
Short-lived pre-signed URLs
The photo goes from your bucket to the API and back to the bucket. The URLs last minutes and never go into attachments or shared logs.
Deliverable: gerar_urls_assinadas.py with a validity capBatch with rate control
A per-minute cap below the organization's limit, increasing backoff when polling status and respect for retry-after.
Cutout or mask
A finished cutout for what goes straight to the catalog; a grayscale mask for what the retoucher still adjusts in desktop Photoshop.
Deliverable: queue with the mode for each photoThe studio's action in the cloud
The action recorded by the retoucher becomes readable steps, reviewed for layers and fixed sizes, and runs on the actions route for the whole batch.
Deliverable: executar_acao.json, reviewedChecks by content
File signature, dimensions, alpha channel in the cutout, empty output, failed jobs and images that didn't come back.
Deliverable: conferencia.csv and a manifest with sha256
02
Eight arms, one checked batch.
The same Octo cycle, applied to the cloud API. Each arm has a narrow role; the ones who sign the contract, authorize the use of the photo and release the catalog are people.
-
Discovery
Surveys actual usage
Which operations are done by hand, at what monthly volume, and whether any old routine still calls v1.
-
Data
Writes the queue and log
Image queue, job log and naming pattern in versioned files.
-
Security
Protects the secret and the photo
Secret in the vault, short-lived pre-signed URLs, logs without tokens, photos of people flagged (LGPD, Brazil's data protection law).
-
Architecture
Chooses the path
Cloud API, a script in desktop Photoshop or a free tool, depending on volume and data restrictions.
-
Development
Writes the controller and the check
Rate cap, increasing backoff, retries only where appropriate and the source of each rule noted.
-
Review
Checks by the image
Alpha, dimensions, empty output, missing and extra. "It returned 200" is not a check.
-
Release
Moves only what passed
From the output prefix to the catalog prefix, with a person's approval.
-
Documentation
Records what applies to your environment
API version, domain in use, limits, who approved each batch and the month's usage.
Octo does not create Adobe accounts, does not keep secrets outside your vault and does not move images to the catalog without approval.
03
Each task, its own route.
The criteria Octo uses to choose, with the documented limit of each path.
| Task | Path | Notes |
|---|---|---|
| Test the credential | A /v2 route with the token (hello is from v1) | Before any batch |
| Remove the background from a folder | /v2/remove-background, cutout mode | One image per call |
| Mask for fine retouching | Same route, mask mode | The retoucher adjusts in desktop Photoshop |
| Apply a recorded action | /v2/execute-actions | Review the steps and test on a sample |
| Automatic tone adjustment | /v2/edit | Operations combined in one call |
| Template with product and price | /v2/create-composite | Fonts from the server or Adobe Fonts |
| Inventory of a PSD archive | /v2/generate-manifest | Without opening Photoshop |
| Track the batch | /v2/status/{jobId} | Increasing backoff; GETs count too |
04
From a loose call to a measured batch.
Three steps. Each one only makes sense after the previous one has shown results on your team.
A proposal, not a promise
Inventory and migration
Octo surveys the routines that already call the API and points out what is still on v1 and any secret outside the vault.
- v1 routes mapped to v2
- Domain as configuration
- Secret in the vault
Batch with a check
Cutouts and actions in batch, with a rate cap, a job log and checking by content.
- Headroom for other teams
- An open item, not infinite retries
- Sample approved by a person
Measured usage
Usage per operation, reprocessing and peaks, so the contract conversation has numbers.
- Monthly usage per operation
- Reprocessing rate
- Peak against the limit
05
Confirmed by a source.
Every point below has a source published by the vendor, by the project or by the responsible agency. The sources are in the next section.
4
points with a published source, each with its reference shown alongside.
- ConfirmedAccess requires an enterprise contract
- An active Firefly Services contract and a Developer Console project with server-to-server credentials; 24-hour token.Source: developer.adobe.com, Photoshop API, Getting started
- Confirmedv1 shut down on Jul 31, 2026
- v2 consolidates routes into
execute-actions,create-compositeandedit, and replacestypewithmediaTypeandhrefwithdestination.Source: developer.adobe.com, v2 GA and migration guide - ConfirmedPer-organization limit
- Overall: soft limit of 300 POST per minute and 300 GET every 3 s. Background removal: 2 POST every 3 s (about 40 per minute). Masking: 60 per minute and 9,000 per day. 429 with
retry-after; only one input image per call.Source: developer.adobe.com, Technical Usage Notes - ConfirmedJob states
not_started,running,succeededandfailed; the controller waits until one of the two terminal states.Source: developer.adobe.com, Status Migration
06
What Octo does, and what stays with you.
Octo prepares everything, but it does not sign. The document of record stays with whoever is accountable for it.
Octo prepares
Surveys, calculates, organizes and produces the documents: processed files, proofs, reports and spreadsheets.
Deliverable: material ready to checkYour team checks
The client or the art director checks what Octo delivered before approving. If something doesn't add up, it goes back to Octo with the correction.
Step: checked by the person who approvesWho approves
Octo does not approve the artwork. Artwork carries no legal signature: approval of the artwork and the proof stays with the client or the art director.
Approval: client or art director
07
Sources.
Photoshop API and Firefly Services documentation on developer.adobe.com, consulted on Oct 31, 2026.
- Photoshop API, overviewv2 GA, features, 5 GB
- Getting startedLicense, token, headers
- Photoshop API v2 GAv1 end of life
- Remove background (v2)Modes, parameters, jobId
- ActionJSONAction body
- Migrating from v1 to v2Route table
- Actions migrationActionJSON in options.actions
- Status migrationJob states
- v2 improvementsStorage, published actions
- Technical Usage NotesPer-service limits, retry-after, fonts
- Firefly Services, guidesAPIs in the package
- Firefly API, limitsFirefly API only
Your Photoshop API, with limits respected and images checked.
The assessment starts with an inventory of the routines that already call the API and a checked sample. You get what is still on v1, where the secret is, the measured usage and the questions only your team can answer, and you decide with that in hand.