You need to provide a URL that somehow encodes everything you need to retrieve the image with, and — yes — have a separate CGI/handler/whatever provide the actual image data.

You may defer creating the data to the second request, if you like: that means no temporary files, and that the IMG url needs to contain ebough info to *create* the image. Alternatively, you can have the first request create the image, store it somewhere (DB or file, doesn't really matter) and only communicate a request ID to the client, which is used to fetch the precomputed image.

You have to think a bit about security here, considering that the second request may need its own authentication so that other people can't "steal" somebody else's image. Also, there's a nice feature of using stored and precomputed images in that caching becomes very easy: *anyone* who requests an image with the paramaters that have already been computed (and optionally, who also passes authentication) will get the data very quickly. You can have a scheduled task that clears up old data from sotrage to prevent it from growing too large (or too stale).