# Developer Documentation
API Reference
Complete REST API documentation. Every feature in the dashboard is available via our API with scoped authentication, webhooks, and predictable resource-oriented URLs.
# Base URL
All API requests are made to this base URL over HTTPS. HTTP requests are rejected. All request and response bodies are JSON-encoded.
# Authentication
Authenticate by including your API key in the Authorization header. Keys are scoped to workspaces and can be created from Settings → API Keys.
# Quick reference
Common endpoints.
# Example
Create a short link.
Request
curl -X POST https://api.mask.bz/v1/links \
-H "Authorization: Bearer mk_live_..." \
-H "Content-Type: application/json" \
-d '{
"url": "https://example.com/long-page",
"slug": "my-link",
"domain": "go.yourbrand.com",
"tags": ["campaign-q1"],
"utm_source": "twitter",
"utm_medium": "social",
"expires_at": "2026-12-31T23:59:59Z"
}'Response
{
"id": "lnk_abc123",
"url": "https://example.com/long-page",
"short_url": "https://go.yourbrand.com/my-link",
"slug": "my-link",
"domain": "go.yourbrand.com",
"tags": ["campaign-q1"],
"clicks": 0,
"utm_source": "twitter",
"utm_medium": "social",
"expires_at": "2026-12-31T23:59:59Z",
"created_at": "2026-03-13T10:00:00Z"
}# Resources
API resources.
Authentication
API key authentication with scoped permissions. Create and manage keys from your workspace settings.
Links
Create, read, update, and delete short links. Supports custom slugs, UTM parameters, expiration, and tags.
Bio Pages
Programmatically create and manage bio pages, blocks, and themes via the API.
QR Codes
Generate QR codes for any link with custom colors, logos, and output formats (SVG, PNG).
Analytics
Query click data with filters for date range, geography, device, referrer, and more.
Webhooks
Subscribe to events like link.created, link.clicked, and page.viewed. Verify signatures for security.
# Rate limits
Fair usage limits.
60
requests / minute
Hobby plan
600
requests / minute
Pro plan
6,000
requests / minute
Enterprise plan
Rate limit headers are included in every response: X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset. When you exceed the limit, the API returns 429 Too Many Requests with a Retry-After header.
# Error handling
HTTP status codes.
Start building today.
Create a free account and generate your first API key in minutes.