URL shortener API

The API does what the dashboard does, without the dashboard: shorten a URL, look up how a link is doing, re-point it somewhere else, retire it. If you can send an HTTP request, you can use it.

Your first request

Three steps, and the third one is the whole API in miniature.

1. Create a key

Open your workspace and go to API keys. Select Create key and give it a name that says where it will be used, like "CI pipeline" or "billing service", because that name is what you will be reading in the audit trail later. Only a workspace Owner or Admin can create keys.

The key is shown once, immediately after you create it. Copy it then: we store only a hash, so nobody, including us, can show it to you again.

2. Send it with every request

Authorization: Bearer url_live_YOUR_KEY

There is no other authentication step. No session, no CSRF token, no workspace id in the path. The key already says which workspace you are acting in. More about keys and how to look after them.

3. Shorten something

curl -X POST "https://urlicer.com/api/v1/links" \
  -H "Authorization: Bearer url_live_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com/blog/2026/the-long-article-title-goes-here"}'

{
  "short": "https://ivi.to/mDpk",
  "code": "mDpk",
  "domain": null,
  "url": "https://example.com/blog/2026/the-long-article-title-goes-here",
  "clicks": 0,
  "active": true,
  "expiresOn": null,
  "createdOn": 1787314771
}

short is the finished link, ready to share. That is the entire happy path.

Conventions

• HTTPS only. Keys travel in a header; plain HTTP would put them on the wire.
• Times are unix seconds, UTC. Never milliseconds, in either direction.
• Errors are JSON with a machine-readable error field, so you can branch on the kind of failure rather than on a message. Every code and what to do about it.
• Forward slashes come back escaped in raw responses, so a URL reads as https:\/\/ivi.to\/mDpk before it is parsed. That is valid JSON and every parser handles it; you will only notice if you are reading bytes rather than parsing them.
• Unknown fields in a request body are ignored, so sending a slightly newer client against a slightly older server does not fail.

The rest of the reference

What your plan changes

Every plan includes the API, including the free one. What differs is how fast you may call it, how many keys you may hold, and which link features those keys may use: custom aliases, expiry, passwords, your own domains, bulk creation. A request for a feature your plan does not include is refused with a feature error naming it, and nothing is created. See rate limits for the numbers, or the plans page for what each tier includes.