MASK

# Developers

Build on MASK.

A complete developer platform for link management automation. REST API, real-time webhooks, scoped API keys, and usage analytics — everything you need to integrate MASK into your product or workflow.

# Quick Start

Create a short link in one request.

Authenticate with your API key, send a POST, and get a trackable short link back. That's it.

# Create a short link
curl -X POST https://mask.sh/api/v1/links \
-H "Authorization: Bearer mk_your_key" \
-H "Content-Type: application/json" \
-d '{"url": "https://example.com/long-url"}'
# Response
{
"data": {
"id": "clx...",
"slug": "abc123",
"originalUrl": "https://example.com/long-url"
}
}

# Capabilities

Everything developers need.

# REST API

Full REST API

Create, read, and manage short links, QR codes, and bio pages programmatically. Paginated responses, consistent JSON schema, and proper error handling.

# Webhooks

Real-Time Webhooks

Subscribe to events like link.created, click.recorded, and subscription.updated. HMAC-SHA256 signed payloads with automatic retries and delivery logs.

# API Keys

Scoped API Keys

Create multiple API keys per workspace with fine-grained scopes. Rotate keys atomically, track last-used timestamps, and revoke instantly.

# Analytics

Usage Analytics

Monitor API consumption per key and per endpoint. Track error rates, rate limit hits, and request volumes over configurable time windows.

# Rate Limiting

Production Rate Limits

Redis-backed rate limiting with standard headers (X-RateLimit-Limit, Remaining, Reset). Graceful 429 responses with clear reset timing.

# Security

Enterprise Security

SHA-256 hashed key storage, bearer token authentication, audit logging for every API action, and workspace-level access isolation.

# Webhook Events

React to events in real time.

Subscribe to workspace events and receive signed HTTP callbacks. Failed deliveries are automatically retried and logged for replay.

link.createdWhen a new short link is created
link.updatedWhen a link's destination or settings change
link.deletedWhen a link is removed
click.recordedWhen a short link receives a click
page.publishedWhen a bio page is published
subscription.updatedWhen a billing plan changes

# API Key Scopes

Least-privilege access.

Assign only the permissions each integration needs. Create read-only keys for analytics or full-access keys for automation.

links:readRead link data
links:writeCreate and modify links
analytics:readAccess analytics data
pages:readRead bio pages
pages:writeManage bio pages
webhooks:readList webhook endpoints
webhooks:writeManage webhooks
team:readView team members

Start building with MASK.

Generate an API key in your workspace settings and make your first request in under a minute.

Ready to get started?

Start building with a free account.
Speak to an expert for your Pro or Enterprise needs.

Explore MASK Enterprise

with an interactive product tour,
trial, or a personalized demo.