Shortit API

All endpoints are authenticated with an API key. Create up to 5 keys in your dashboard.

Base URL

https://shortit.in

Authentication

Preferred: the header X-API-Key: YOUR_TOKEN. The parameter api_key also works, but ends up in server logs and browser history — use it only when a header is impossible.

Errors always look like {"error":"..."}.

Times are UTC

Every timestamp we store and return is UTC. Fields ending in _iso spell that out in ISO 8601 (2026-08-13T14:37:21Z); the plain fields are the same moment in YYYY-MM-DD HH:MM:SS, also UTC. Parse the _iso variant if you can — then there is nothing to guess.

The link object

Creating, fetching, listing and updating all return the same shape:

{
  "slug": "abc12",
  "short_url": "https://shortit.in/abc12",
  "type": "url",                            // "url" or "image"
  "target_url": "https://example.com",      // null for an uploaded image
  "hits": 12,
  "created_at": "2026-08-12 13:57:09",
  "created_at_iso": "2026-08-12T13:57:09Z",
  "expires_at": "2026-09-11 13:57:09",      // null when it never expires
  "expires_at_iso": "2026-09-11T13:57:09Z",
  "mime": "image/png",                      // images only
  "size": 20481                             // images only, bytes
}

Custom slugs

Both create endpoints accept an optional slug. Rules: 3–32 characters, letters, digits, - and _, starting and ending with a letter or digit. Taken or reserved slugs return 409. Leave it out and you get a short random one.

Create short URL

GET /api/shorten · POST /api/shorten

Parameters

• url (required) — the target, http or https only
• ttl (optional) — one of 1h, 3h, 6h, 12h, 1d, 7d, 30d, 1y, always. Default 1d
• slug (optional) — your own slug, see above

Examples

curl -H "X-API-Key: YOUR_TOKEN" \
  "https://shortit.in/api/shorten?url=https://example.com&ttl=7d"

curl -X POST "https://shortit.in/api/shorten" \
  -H "Content-Type: application/json" \
  -H "X-API-Key: YOUR_TOKEN" \
  -d '{"url":"https://example.com","ttl":"7d","slug":"release-notes"}'

Upload an image

POST /api/upload — the image is served inline on its own short URL.

Parameters (multipart/form-data)

• file (required) — png, jpg, gif, webp, avif, bmp, svg or ico
• ttl (optional) — same values as above. Default 1y
• slug (optional) — your own slug, see above

Example

curl -X POST "https://shortit.in/api/upload" \
  -H "X-API-Key: YOUR_TOKEN" \
  -F "file=@/path/to/image.png" \
  -F "ttl=7d"

Fetch one link

GET /api/urls/{slug} — returns the link object, or 404 if it does not exist or is not yours.

Use this to check a link you stored earlier. Deleting frees the slug, so it can be handed out again later — possibly to somebody else. A 404 here means your copy is stale; a 200 means it is still your link.

curl -H "X-API-Key: YOUR_TOKEN" "https://shortit.in/api/urls/abc12"

List your links

GET /api/urls — newest first.

Parameters

• page (optional) — default 1
• per_page (optional) — default 50, maximum 200
• q (optional) — filter on slug or target

Response

{
  "links": [ { ...link object... } ],
  "total": 176,
  "page": 1,
  "pages": 4,
  "per_page": 50
}

curl -H "X-API-Key: YOUR_TOKEN" "https://shortit.in/api/urls?per_page=100&page=2"

Change the expiry

PATCH /api/urls/{slug} — extend or shorten the life of an existing link without re-uploading it. The URL you already shared keeps working.

Parameters

• ttl (required) — one of 1h, 3h, 6h, 12h, 1d, 7d, 30d, 1y, always, counted from now

Returns the updated link object. For clients that cannot send PATCH: POST /api/update with slug and ttl.

curl -X PATCH "https://shortit.in/api/urls/abc12" \
  -H "X-API-Key: YOUR_TOKEN" \
  -d "ttl=1y"

Delete a link

DELETE /api/urls/{slug}

Removes the short link. If it was an upload, the file itself is deleted too. You can only delete links that belong to your own account; anything else returns 404.

Alternative

For clients that cannot send DELETE: POST /api/delete with slug as a parameter. Both a bare slug and a full short URL are accepted.

Response

{
  "deleted": true,
  "slug": "abc12"
}

curl -X DELETE "https://shortit.in/api/urls/abc12" \
  -H "X-API-Key: YOUR_TOKEN"

Deleting is permanent: the slug is released and can be handed out again later.