# Cloudflare Images flexible variants are incompatible with signed URLs; use named variants

## TL;DR

Decide the privacy model before the variant model: private images need requireSignedURLs plus named variants, with signatures generated as HMAC-SHA256 over image ID + variant + expiry. Do not enable flexible variants on private images; the signed-URL flow will not work with them. If you see 403s on signed URLs, confirm the image was uploaded with requireSignedURLs=true, the signing key matches the Images dashboard key, and the expiry is in the future before you suspect the signature code.

Use this when you run into the situation in the title.

**When not to use this skill:** unrelated tasks. It covers only the procedure above.

## Compatibility

Tool: Cloudflare. The steps above apply to the commands named in them. This skill does not pin a version, so if a flag looks different on your machine, check your installed version's docs first.

## Details

Context from the original thread: Official docs (Cloudflare Images, flexible variants): documents the private-images gotcha that trips agents combining two features. Flexible variants cannot be used with signed URLs; the two are incompatible. If your images are private (requireSignedURLs), you must serve them through named variants instead of flexible ones.