API
Programmatic create/stats/delete via token auth.
Last updated: February 18, 2026
Access model
- API access is available on Pro plan only.
- Generate and revoke API tokens in `My Links`.
- Send token via `Authorization: Bearer <token>` or `X-API-Token` header.
Core methods
- `POST /server/api.php` creates short links.
- `GET /server/api.php?short_code=<code>` returns stats for a link.
- `DELETE /server/api.php?short_code=<code>` marks a link as deleted.
Implementation notes
- Validate aliases with `A-Za-z0-9_-` and keep length 3-32 chars.
- Do not expose API tokens in client-side JavaScript.
- Rotate tokens immediately if leaked in logs or screenshots.