Integrate ilync in minutes

ilync turns long URLs into short, shareable codes and redirects visitors to the original destination. Use it from the browser or programmatically over a small JSON API.

• Instant shortening
• Accounts & dashboard
• Optional expiration
• Click analytics
• QR & barcode API
• API keys & rate limits
• Advanced safety screening
• Free public URL checker
• Link in bio pages
• Private links
• Passcode-protected links
• Avatar upload & removal
• Admin link management
• Custom domains
• Light & dark themes

ilync is a hosted HTTP service, so there is nothing to install or deploy to start using it. Point your application at the API and you can create short links in minutes. Every endpoint accepts and returns JSON over HTTPS.

1. Get an API key (recommended)

Anonymous requests work out of the box with a lower rate limit. For higher limits, link ownership, and private links, sign in and create a key under Developer API, then send it as a bearer token on each request. Store it as a secret in your backend — never ship it in client-side code.

2. Create your first short link

Send a POST to /api/urls with the URL to shorten. The Authorization header is optional but recommended for production integrations.

curl -X POST https://ilync.dev/api/urls \
  -H 'Content-Type: application/json' \
  -H 'Authorization: Bearer ilk_your_key_here' \
  -d '{"url":"https://example.com/a/very/long/path"}'

const res = await fetch("https://ilync.dev/api/urls", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    Authorization: "Bearer ilk_your_key_here", // optional
  },
  body: JSON.stringify({ url: "https://example.com/a/very/long/path" }),
});

if (!res.ok) throw new Error(`ilync error: ${res.status}`);

const { shortUrl } = await res.json();
console.log(shortUrl); // → https://ilync.dev/Ab3xK9

import requests

res = requests.post(
    "https://ilync.dev/api/urls",
    json={"url": "https://example.com/a/very/long/path"},
    headers={"Authorization": "Bearer ilk_your_key_here"},  # optional
    timeout=10,
)
res.raise_for_status()
print(res.json()["shortUrl"])  # → https://ilync.dev/Ab3xK9

3. Use the response

A successful call returns 201 Created with the short link. Persist shortUrl (or shortCode) and hand it to your users — visiting it issues a 307 redirect to the original destination.

{
  "shortCode": "Ab3xK9",
  "shortUrl": "https://ilync.dev/Ab3xK9",
  "originalUrl": "https://example.com/a/very/long/path",
  "expiresAt": null,
  "createdAt": "2026-07-11T21:50:00.000Z",
  "isPrivate": false,
  "ownerId": null
}

That's the whole loop. From here, see Create a link for every request field, Authentication for keys, and Rate limits to size your usage.

1. Paste a long URL into the form on the home page.
2. Optionally set a custom short code and/or pick an expiration.
3. Signed in? Add an optional passcode — visitors must enter it before being redirected.
4. Submit — the short link appears with Copy, a QR / barcode generator, and a link to stats.
5. The Recently shortened list shows recent public links and their click counts; open a link's stats page at /{code}/stats.

Links created while signed out are public and appear in the landing-page feed. Links you create while signed inare unlisted — hidden from the public feed and tracked in your account's My links dashboard instead (they stay fully redirectable). Expired links are excluded from the public feed automatically.

To add or remove a passcode on an existing link, open it in your account's My links dashboard and use the Edit panel (see Passcodes).

Accounts support Google and email/password sign-in. Visit /account to sign in or create one. Signing in is required to save links and to mint API keys. Email/password accounts receive a verification link on sign-up — click it to confirm your address (you can re-send it any time from the dashboard).

Your saved links and profile are private to your account — only you can read or modify them.

Claim a public page at /@username and publish social profiles plus custom buttons — ideal for Instagram, TikTok, and other bios. Edit everything from /link (also linked from your account). Signing in is required to create or update a page.

HTTP API

Signed-in clients can load and save the page with an ID token (same bearer auth used elsewhere for account actions).

Returns your page, or { "bio": null } if you have not created one yet.

curl https://ilync.dev/api/bio \
  -H 'Authorization: Bearer <id-token>'

{ "bio": null }

curl -X PUT https://ilync.dev/api/bio \
  -H 'Authorization: Bearer <id-token>' \
  -H 'Content-Type: application/json' \
  -d '{
    "username": "you",
    "displayName": "Your name",
    "tagline": "Creator · Builder",
    "published": true,
    "links": [
      { "kind": "social", "platform": "instagram", "label": "Instagram", "url": "you" },
      { "kind": "custom", "label": "My shop", "url": "https://example.com/shop" }
    ]
  }'

Returns visit analytics for your link-in-bio page, broken down by time period.

curl https://ilync.dev/api/bio/analytics \
  -H 'Authorization: Bearer <id-token>'

{
  "total": 1284,
  "periods": {
    "24h": 42,
    "3d": 118,
    "7d": 256,
    "30d": 890,
    "60d": 1203
  }
}

Returns 307 Temporary Redirect with a Locationheader pointing to the original URL. For private links, send the owner's or a granted user's key. Public redirects are rate-limited to reduce scraping and abuse — over-limit clients receive 429.

Links with a passcode return an HTML page asking for the passcode instead of an immediate redirect. Entering it sets a short-lived cookie and then redirects — see Passcodes.

curl -i https://ilync.dev/Ab3xK9 \
  -H 'Authorization: Bearer ilk_your_key_here'

Grants another user (by their userId) permission to follow a private link.

curl -X POST https://ilync.dev/api/urls/Ab3xK9/access \
  -H 'Content-Type: application/json' \
  -H 'Authorization: Bearer ilk_owner_key_here' \
  -d '{"userId":2}'

Returns click totals and breakdowns. Recording happens off the redirect hot path, so it never slows a redirect. A human-friendly page also lives at /{code}/stats.

curl https://ilync.dev/api/analytics/Ab3xK9

{
  "shortCode": "Ab3xK9",
  "originalUrl": "https://example.com/…",
  "clicks": 4,
  "byPlatform": [
    { "platform": "iOS", "count": 1 },
    { "platform": "Windows", "count": 1 }
  ],
  "recent": [
    { "createdAt": "…", "referrer": "https://twitter.com/", "platform": "iOS" }
  ]
}

Generate a QR code or 1D barcode from any value — a short link, a product SKU, a serial number. Auth is optional. CORS is open, so you can call this from a browser app or drop the GET URL into an <img>. A visual playground lives at /code.

Embed as an image

GET returns the image bytes. Use it as an src — no SDK, no key required for modest volume. Anonymous GET responses are cacheable.

<img
  src="https://ilync.dev/api/codes?value=https%3A%2F%2Filync.dev%2FAb3xK9&format=QR&size=256"
  alt="QR code for https://ilync.dev/Ab3xK9"
  width="256"
  height="256"
/>

curl "https://ilync.dev/api/codes?value=https%3A%2F%2Filync.dev%2FAb3xK9&format=QR&size=512" \
  -o qr.png

curl "https://ilync.dev/api/codes?value=HELLO-42&format=CODE128&output=svg&fg=%2318181b&bg=%23ffffff" \
  -o barcode.svg

POST from an app

POST the same fields as JSON. Send an API key for the higher quota. output=json is the easiest path when you cannot handle raw image bytes.

curl -X POST https://ilync.dev/api/codes \
  -H 'Content-Type: application/json' \
  -H 'Authorization: Bearer ilk_your_key_here' \
  -d '{"value":"https://ilync.dev/Ab3xK9","format":"QR","size":512}' \
  -o qr.png

curl -X POST https://ilync.dev/api/codes \
  -H 'Content-Type: application/json' \
  -d '{"value":"5901234123457","format":"EAN13","output":"json"}'

{
  "format": "EAN13",
  "value": "5901234123457",
  "output": "png",
  "mimeType": "image/png",
  "size": 512,
  "data": "iVBORw0KGgoAAAANSUhEUgAA..."
}

const res = await fetch("https://ilync.dev/api/codes", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "X-API-Key": "ilk_your_key_here",
  },
  body: JSON.stringify({ value: "https://ilync.dev/Ab3xK9", format: "QR" }),
});
const blob = await res.blob();
const url = URL.createObjectURL(blob);

Add a logo

Pass logo to sit a brand mark in the center of a QR code. It accepts a public image URL or a data:image/...;base64, URI, up to 2 MB. The result is rounded and given a quiet-zone backing, matching the /code playground. Use errorCorrection=H so the code still scans. Because + and / in a data URI can be mangled in a query string, send data URIs as JSON on POST.

curl -X POST https://ilync.dev/api/codes \
  -H 'Content-Type: application/json' \
  -d '{"value":"https://ilync.dev/Ab3xK9","format":"QR","size":512,"output":"png","errorCorrection":"H","logo":"https://cdn.example.com/logo.png"}' \
  -o qr-with-logo.png

curl -X POST https://ilync.dev/api/codes \
  -H 'Content-Type: application/json' \
  -d '{"value":"https://ilync.dev/Ab3xK9","format":"QR","errorCorrection":"H","logo":"data:image/png;base64,iVBORw0KGgo..."}' \
  -o qr-with-logo.png

You must have an account. Create a key from the account dashboard (easiest), or call the endpoint directly with your account ID token as a bearer token. The plaintext key is returned once (only its hash is stored) plus your userId.

curl -X POST https://ilync.dev/api/keys \
  -H 'Authorization: Bearer <YOUR_ID_TOKEN>' \
  -H 'Content-Type: application/json' \
  -d '{"label":"my-app"}'

{ "apiKey": "ilk_6I2kaePfLIiEUUvVHHYMaBDzPre4npf4", "label": "my-app", "userId": 1 }

List your keys with GET /api/keys:

curl https://ilync.dev/api/keys \
  -H 'Authorization: Bearer <YOUR_ID_TOKEN>'

{
  "keys": [
    { "id": 1, "label": "my-app", "prefix": "ilk_6I2k", "createdAt": "2026-07-11T21:50:00.000Z" }
  ]
}

And revoke one with DELETE /api/keys/{id} (same bearer token):

curl -X DELETE https://ilync.dev/api/keys/1 \
  -H 'Authorization: Bearer <YOUR_ID_TOKEN>'

Actively deletes every expired link (expired links are also removed lazily when someone tries to follow them, and are hidden from the public feed immediately). Pass CLEANUP_SECRETas a bearer token when set; when unset, it's reachable only outside production. Trigger it on a schedule.

curl -X POST https://ilync.dev/api/cleanup \
  -H 'Authorization: Bearer <CLEANUP_SECRET>'

Exchanges email + password for an ID token. Intended for headless / programmatic access — scripts, CLI, server-to-server. The web UI uses the client SDK directly.

curl -X POST https://ilync.dev/api/auth/sign-in \
  -H 'Content-Type: application/json' \
  -d '{"email":"user@example.com","password":"your-password"}'

{ "idToken": "eyJ…", "expiresIn": "3600" }

Use the returned idToken as Authorization: Bearer <idToken> on any endpoint that accepts authentication (e.g. POST /api/keys, PUT /api/bio). The token expires after expiresIn seconds (typically 3600).

Upload, serve, and remove profile photos. Avatars are stored in Vercel Blob under avatars/{uid}/ and served through a proxy endpoint with caching.

Upload a profile photo as multipart/form-data with a file field. Max 4 MB; allowed types: JPEG, PNG, WebP, GIF.

curl -X POST https://ilync.dev/api/upload/avatar \
  -H 'Authorization: Bearer <ID_TOKEN>' \
  -F 'file=@photo.jpg'

{
  "url": "/api/avatar?pathname=avatars%2Fabc123%2F1700000000.jpg",
  "blobUrl": "https://..."
}

Serves an avatar image with the correct Content-Type header and a 24-hour cache directive. No authentication required.

curl "https://ilync.dev/api/avatar?pathname=avatars%2Fabc123%2F1700000000.jpg" \
  -o avatar.jpg

Removes an avatar from blob storage. The pathname must belong to the requesting user.

curl -X DELETE "https://ilync.dev/api/avatar?pathname=avatars%2Fabc123%2F1700000000.jpg" \
  -H 'Authorization: Bearer <ID_TOKEN>'

Register custom domains for serving short links. Each account can register up to 3 domains. Verification is done via a DNS TXT record.

List your registered custom domains.

curl https://ilync.dev/api/domains -H 'Authorization: Bearer <ID_TOKEN>'

{
  "domains": [
    {
      "id": 1,
      "domain": "go.example.com",
      "verified": false,
      "verificationToken": "abc123...",
      "createdAt": "2026-07-20T10:00:00.000Z"
    }
  ]
}

Register a new custom domain.

curl -X POST https://ilync.dev/api/domains \
  -H 'Authorization: Bearer <ID_TOKEN>' \
  -H 'Content-Type: application/json' \
  -d '{"domain":"go.example.com"}'

{
  "domain": {
    "id": 1,
    "domain": "go.example.com",
    "verified": false,
    "verificationToken": "abc123...",
    "instructions": "Add a TXT record: _ilync.go.example.com with value \"abc123...\""
  }
}

Permanently delete your account and all associated data. This action is irreversible and removes all links, API keys, access grants, and Firestore data.

The confirm field must be exactly "DELETE_MY_ACCOUNT". The web UI additionally requires typing the word DELETE in a prompt before calling this endpoint.

curl -X DELETE https://ilync.dev/api/account \
  -H 'Authorization: Bearer <ID_TOKEN>' \
  -H 'Content-Type: application/json' \
  -d '{"confirm":"DELETE_MY_ACCOUNT"}'

{ "deleted": true }

• Sign in first. Minting keys requires an account — create one from the account dashboard, then generate keys there. For programmatic sign-in, use POST /api/auth/sign-in.
• Send a key using either Authorization: Bearer ilk_… or X-API-Key: ilk_…:
  via Authorization header

  Copy

  curl -X POST https://ilync.dev/api/urls \
    -H 'Content-Type: application/json' \
    -H 'Authorization: Bearer ilk_your_key_here' \
    -d '{"url":"https://example.com/long"}'

  same request via X-API-Key header

  Copy

  curl -X POST https://ilync.dev/api/urls \
    -H 'Content-Type: application/json' \
    -H 'X-API-Key: ilk_your_key_here' \
    -d '{"url":"https://example.com/long"}'

• A valid key raises your rate limit, marks you as the owner of links you create, and enables private links.
• Keys are stored only as SHA-256 hashes — the plaintext is shown once at creation, so save it.

Applied to POST /api/urls. Every response carries X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset; a 429 also includes Retry-After.

GET and POST /api/codes use a separate quota so generating barcodes does not eat your shortening budget:

Public redirects (/{code}) are also capped to limit scrapers and redirect abuse: 120 / IP, 60 / IP+code, and 300 / code per 60 seconds. Over-limit redirects return 429.

When a short link is created, ilync checks the destination before it is saved. Failed checks return 400 with a clear error — nothing extra is required on the request.

{ "error": "That destination is not allowed (private or reserved host)." }

Safety doesn't stop at creation

Destinations are re-evaluated over a link's lifetime. If a site turns hostile after the link was saved, it stops redirecting silently: visitors see a warning interstitial describing the risk before choosing to continue, and severely dangerous destinations are disabled outright.

Score any URL without shortening it

The same pipeline backs a public endpoint — no account or key required. Send a URL to POST /api/safety-check (rate-limited to 10 requests per minute per IP) and receive a 0–100 score, a safe / suspicious / dangerous verdict, and every signal that ran:

curl -s https://ilync.dev/api/safety-check \
  -H "Content-Type: application/json" \
  -d '{"url":"https://example.com"}'

{
  "url": "https://example.com/",
  "host": "example.com",
  "score": 96,
  "rating": "safe",
  "signals": [
    { "id": "dns", "status": "pass", "detail": "Resolved to a public address." },
    { "id": "ml-phishing", "status": "pass", "detail": "No phishing signals detected." }
  ]
}

1. Owner signs in and mints a key → gets apiKey and userId (say 1).
2. Owner creates a link with "private": true using their key.
3. Following the link works only with the owner's key; anyone else gets 401.
4. The other user signs in and mints their own key to obtain their userId (say 2).
5. Owner grants access: POST /api/urls/{code}/access with { "userId": 2 }.
6. User 2 can now follow the link with their key.

Because access is enforced via an API-key header, private links are API-oriented — not a click-through-in-a-browser flow unless the client sends the key.

# 1. Owner creates a private link with their key
curl -X POST https://ilync.dev/api/urls \
  -H 'Content-Type: application/json' \
  -H 'Authorization: Bearer ilk_owner_key' \
  -d '{"url":"https://example.com/secret","private":true}'
# → { "shortCode": "Ab3xK9", "isPrivate": true, ... }

# 2. Owner grants user 2 access
curl -X POST https://ilync.dev/api/urls/Ab3xK9/access \
  -H 'Content-Type: application/json' \
  -H 'Authorization: Bearer ilk_owner_key' \
  -d '{"userId":2}'

# 3. User 2 follows the link with their own key (owner can too)
curl -i https://ilync.dev/Ab3xK9 \
  -H 'Authorization: Bearer ilk_user2_key'
# → 307 redirect to https://example.com/secret

# 4. Anonymous / non-granted users are refused
curl -i https://ilync.dev/Ab3xK9   # → 401

A passcode is a shared secret that visitors must enter before a short link redirects. It is different from private links: anyone who knows the code can reach the passcode page, but only people with the passcode get redirected.

How it works

• Only signed-in users (or API-key holders) can protect a link. Anonymous callers cannot set a passcode.
• The passcode is never stored or returned in plaintext — only a salted hash is kept. The API reports a boolean hasPasscode instead.
• Passcode-protected links are hidden from the public feed and are rate-limited so passcodes can't be brute-forced.

Visitor flow

1. Opening /{code} shows a passcode prompt.
2. A correct passcode sets a signed, short-lived (30 min), HttpOnly cookie and redirects to the destination.
3. Incorrect entries return an error and are rate-limited per IP.

Setting or clearing a passcode

Set one when creating a link via POST /api/urls with a passcode field (requires auth), or from the Edit panel in your account dashboard.

Change or remove the passcode on an existing link you own. A non-empty passcode sets a new one; { "passcode": "" } or { "passcode": null } clears it.

curl -X PATCH https://ilync.dev/api/urls/Ab3xK9/passcode \
  -H 'Content-Type: application/json' \
  -H 'Authorization: Bearer <firebase-id-token>' \
  -d '{"passcode":"season-pass"}'

curl -X PATCH https://ilync.dev/api/urls/Ab3xK9/passcode \
  -H 'Content-Type: application/json' \
  -H 'Authorization: Bearer <firebase-id-token>' \
  -d '{"passcode":""}'

• Set expiresAt on creation as an ISO 8601 string or epoch milliseconds. It must be in the future.
  create an expiring link

  Copy

  curl -X POST https://ilync.dev/api/urls \
    -H 'Content-Type: application/json' \
    -H 'Authorization: Bearer ilk_your_key_here' \
    -d '{"url":"https://example.com/promo","expiresAt":"2026-12-31T23:59:59Z"}'

• Expired links return 410 Gone and are removed on access (passive cleanup).
  following an expired link

  Copy

  curl -i https://ilync.dev/Ab3xK9   # → 410 Gone

• Run POST /api/cleanup on a schedule for active cleanup.
  trigger active cleanup

  Copy

  curl -X POST https://ilync.dev/api/cleanup \
    -H 'Authorization: Bearer <CLEANUP_SECRET>'

ilync uses cookies and similar technologies for analytics, preferences, and authentication. You can review the full breakdown in the privacy policy. First-time visitors are shown a consent banner that lets them accept or decline analytics cookies.

Errors use standard HTTP status codes and return a JSON body with a human-readable error message. Always check the status code before parsing a success response.

{ "error": "Invalid URL: must be a valid http(s) address." }