I am not sure what server does, but for that repo to work, server does not even need any steganography, as the it has a database.

On "create", it picks a random image, hashes it and stores (user-id, secret, text) in database

On "extract", it's opposite - accept image, hash, fetch from db.

All the API calls would work just the same, no cryptography of any kind needed.