URL Shortener API
Create iny.one short links from your own scripts, backends or automations with a single JSON POST. The API applies the same UTM tagging, safety screening and analytics as the web shortener — and, like everything else here, it never puts an ad page in front of your visitors.
Endpoint
One endpoint does the work. Send the destination URL plus a utm object with source, medium and campaign; pass empty strings for any UTM field you don't want to tag.
POST https://iny.one/api/shorten
Request
- url — string · required
- Destination URL. http(s) only; bare domains get https:// added. IP addresses and iny.one itself are rejected.
- utm.source — string · required (may be empty)
- Where the traffic comes from, e.g. newsletter, google. Sanitized to letters, numbers, hyphens and underscores.
- utm.medium — string · required (may be empty)
- Channel type, e.g. email, cpc, social.
- utm.campaign — string · required (may be empty)
- Campaign name, e.g. july_launch.
cURL
curl -X POST https://iny.one/api/shorten \
-H "Content-Type: application/json" \
-d '{
"url": "https://example.com/landing",
"utm": {
"source": "newsletter",
"medium": "email",
"campaign": "july_launch"
}
}'JavaScript (fetch)
const res = await fetch("https://iny.one/api/shorten", {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({
url: "https://example.com/landing",
utm: { source: "newsletter", medium: "email", campaign: "july_launch" },
}),
});
const json = await res.json();
// json.data.short -> "https://iny.one/abc1234"Response
Successful calls return HTTP 200 with the short link in data.short. Validation problems return 422, and hitting your monthly quota returns 429 — both with the same error envelope.
200 OK
{
"success": true,
"data": {
"short": "https://iny.one/abc1234"
},
"meta": {
"requestId": "3f6f4c1e-…",
"timestamp": "2026-07-21T12:00:00.000Z"
}
}422 / 429
{
"success": false,
"error": {
"code": "RATE_LIMIT_EXCEEDED",
"message": "…",
"status": 429,
"type": "…"
},
"meta": { "requestId": "…", "timestamp": "…" }
}Rate limits
| Tier | Limit | Notes |
|---|---|---|
| Anonymous (per IP) | 5 links / month | Links expire after 180 days |
| Free account | 50 links / month | Links never expire; dashboard analytics included |
| Basic | 1,000 links / month | Adds utm_content and utm_term |
| Pro | 10,000 links / month | Adds utm_id |
Good to know
- POST with a JSON body only — there is no GET /shorten?url= endpoint, so destinations never leak into logs or referrers.
- Destination domains are screened against a blocklist of unsafe domains before a link is created.
- Authenticated calls currently reuse the web session (cookies). Dedicated API keys are on the roadmap.
- Redirects respond with an HTTP 307 and are excluded from search indexing, so your destination page keeps the SEO signals.
API FAQ
Is the API free?
Yes, within the same monthly limits as the web app — see the table above. No credit card needed for the anonymous and free tiers.
Do I need an API key?
Not for anonymous use. Dedicated API keys are planned; today authenticated calls use the same session as the web app.
Is there a GET endpoint?
No — JSON POST only. It keeps URLs and UTM values out of server logs and referrer headers.
Do API links expire?
Anonymous links expire after 180 days; links created while signed in don't expire.
Need more volume? Compare plansPrefer the web form? Shorten a URL