QUICK START

Create expiring short links with one POST.

Send a URL with an optional name and timer. The API returns a shortcode and its expiry time. The other endpoints read or delete links you have created. API keys are a Max feature — Free and Pro use the dashboard.

POST/api/links

REQUESTshell · example

curl -X POST https://shor10.co/api/links \
  -H "Authorization: Bearer sk_live_xxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{"originalUrl":"https://example.com/very/long/path","alias":"spring-sale","ttl":"7d"}'

BODY

originalUrlrequiredAny absolute http(s) URL.

aliasoptionala-z, 0-9 and dashes, 3 to 32 characters. Random if omitted.

ttloptional1h · 24h · 7d · 30d · "never". Omit it and the link expires in 24 hours.

201 CREATED

{
  "shortcode": "spring-sale",
  "shortUrl": "https://shor10.co/spring-sale",
  "expiresAt": "2026-08-03T09:00:00Z"
}

Deleting a link

This works like deleting from the Dashboard. The shortcode stops resolving immediately. Its history is archived, and only the owning account can delete it with a session or Bearer key.

DELETE/api/links/:id→ 204, empty body

curl -X DELETE https://shor10.co/api/links/<id> \
  -H "Authorization: Bearer sk_live_xxxxxxxxxxxx"

Status codes

CODEMEANINGWHENCODES

201CreatedThe link exists and is live.CODESNo error code

302FoundWhat a visitor gets on shor10.co/shortcode.CODESNo error code

400Bad requestA field broke a rule, and the response names it in field. invalid_json carries no field — the body never parsed, so there is nothing to name. More 400 codes exist than these.CODESinvalid_jsonoriginal_url_requiredalias_charsetttl_preset_invalid

401UnauthorizedThe Bearer key is missing, malformed, or revoked. POST answers 401 the same way once a key is presented; a POST with no credentials at all makes a guest link instead.CODESunauthorized

403ForbiddenThe key is valid, but your plan does not cover the request. custom_alias_requires_pro names field; monthly_link_limit and api_keys_require_max gate the account rather than a field, and carry none.CODESapi_keys_require_maxcustom_alias_requires_promonthly_link_limit

409ConflictThat alias is taken. The response body suggests a free one.CODESalias_taken

404Not foundNothing resolves for that shortcode — never issued, deleted, or owned by another account.CODESlink_not_found

410GoneWhat a visitor gets once the link’s time is up: the branded expired page, served as HTML rather than JSON.CODESNo error code

429Too many requestsMore than 120 Bearer calls in a minute on one key. Retry-After is in seconds. The guest create path is rate-limited too, and sends no Retry-After.CODESapi_key_rate_limited

503Service unavailableLink storage did not answer, or the key lookup could not reach it.CODESlink_storage_unavailable

Create a key in Settings

Create a key under Settings > API keys, then send Authorization: Bearer sk_live_… with GET/POST /api/links and DELETE /api/links/:id

Open API keys