Developers
Build on MASK.
A REST API for links, QR codes and conversions, signed webhooks for the events your workspace produces, scoped API keys, and usage analytics for the keys you issue.
Quick Start
Create a short link in one request.
Authenticate with your API key, send a POST, and get a trackable short link back. That's it.
Capabilities
Everything developers need.
REST API
REST API
Create, read, and manage short links and QR codes, and record and read conversions. Paginated responses, consistent JSON schema, and proper error handling.
Webhooks
Real-Time Webhooks
Subscribe to events like link.created, conversion.created, and analytics.spike. HMAC-SHA256 signed payloads with automatic retries and delivery logs.
API Keys
Scoped API Keys
Create multiple API keys per workspace with fine-grained scopes. Roll a key over by creating its replacement before revoking it, track last-used timestamps, and revoke instantly.
Analytics
Usage Analytics
Monitor API consumption per key and per endpoint. Track error rates, rate limit hits, and request volumes over configurable time windows.
Rate Limiting
Production Rate Limits
Redis-backed rate limiting at 60 requests per minute per key. A 429 carries X-RateLimit-Limit, Remaining, Reset and Retry-After, so a client knows exactly when to come back.
Security
Enterprise Security
SHA-256 hashed key storage, bearer token authentication, audit logging for every API write, and workspace-level access isolation. A key reaches only the workspace it was created in.
Webhook Events
React to events in real time.
Subscribe to workspace events and receive signed HTTP callbacks. Failed deliveries are automatically retried and logged for replay.
link.createdWhen a new short link is createdlink.updatedWhen a link's destination or settings changelink.deletedWhen a link is removedpage.publishedWhen a bio page is publishedqr.createdWhen a QR code is createddomain.verifiedWhen a custom domain passes verificationconversion.createdWhen your server records a conversionanalytics.spikeWhen a link's click rate breaks out of its own baselineAPI Key Scopes
Least-privilege access.
Assign only the permissions each integration needs. Fourteen scopes exist; four of them gate the endpoints that are live today, and the ones marked Reserved can be granted but are not yet required by anything.
links:readRead link datalinks:writeCreate, modify and delete links, and create QR codesconversions:writeRecord conversionsconversions:readRead conversion totals, goals and goal reportspages:readReservedpages:writeReservedanalytics:readReservedqr:readReservedqr:writeReservedteam:readReservedteam:writeReservedwebhooks:readReservedwebhooks:writeReserveddomains:readReservedStart building with MASK.
Generate an API key in your workspace settings and make your first request in under a minute.