MASK

Developers

Build on MASK.

A REST API for links, QR codes and conversions, signed webhooks for the events your workspace produces, scoped API keys, and usage analytics for the keys you issue.

Quick Start

Create a short link in one request.

Authenticate with your API key, send a POST, and get a trackable short link back. That's it.

# Create a short link
curl -X POST https://mask.pk/api/v1/links \
-H "Authorization: Bearer mk_your_key" \
-H "Content-Type: application/json" \
-d '{"url": "https://example.com/long-url"}'
# Response
{
"data": {
"id": "clx...",
"slug": "abc123",
"originalUrl": "https://example.com/long-url"
}
}

Capabilities

Everything developers need.

REST API

REST API

Create, read, and manage short links and QR codes, and record and read conversions. Paginated responses, consistent JSON schema, and proper error handling.

Webhooks

Real-Time Webhooks

Subscribe to events like link.created, conversion.created, and analytics.spike. HMAC-SHA256 signed payloads with automatic retries and delivery logs.

API Keys

Scoped API Keys

Create multiple API keys per workspace with fine-grained scopes. Roll a key over by creating its replacement before revoking it, track last-used timestamps, and revoke instantly.

Analytics

Usage Analytics

Monitor API consumption per key and per endpoint. Track error rates, rate limit hits, and request volumes over configurable time windows.

Rate Limiting

Production Rate Limits

Redis-backed rate limiting at 60 requests per minute per key. A 429 carries X-RateLimit-Limit, Remaining, Reset and Retry-After, so a client knows exactly when to come back.

Security

Enterprise Security

SHA-256 hashed key storage, bearer token authentication, audit logging for every API write, and workspace-level access isolation. A key reaches only the workspace it was created in.

Webhook Events

React to events in real time.

Subscribe to workspace events and receive signed HTTP callbacks. Failed deliveries are automatically retried and logged for replay.

link.createdWhen a new short link is created
link.updatedWhen a link's destination or settings change
link.deletedWhen a link is removed
page.publishedWhen a bio page is published
qr.createdWhen a QR code is created
domain.verifiedWhen a custom domain passes verification
conversion.createdWhen your server records a conversion
analytics.spikeWhen a link's click rate breaks out of its own baseline

API Key Scopes

Least-privilege access.

Assign only the permissions each integration needs. Fourteen scopes exist; four of them gate the endpoints that are live today, and the ones marked Reserved can be granted but are not yet required by anything.

links:readRead link data
links:writeCreate, modify and delete links, and create QR codes
conversions:writeRecord conversions
conversions:readRead conversion totals, goals and goal reports
pages:readReserved
pages:writeReserved
analytics:readReserved
qr:readReserved
qr:writeReserved
team:readReserved
team:writeReserved
webhooks:readReserved
webhooks:writeReserved
domains:readReserved

Start building with MASK.

Generate an API key in your workspace settings and make your first request in under a minute.