Short links

Create a short link

POST /public/v1/short-links

Request body

Example

curl -X POST https://api.to.it.com/v1/short-links \
  -H "Authorization: Bearer toit_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"targetUrl": "https://example.com", "slug": "demo"}'

Scheduled launch with countdown

curl -X POST https://api.to.it.com/v1/short-links \
  -H "Authorization: Bearer toit_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "targetUrl": "https://example.com/launch",
    "slug": "launch",
    "title": "Product launch",
    "startsAt": "2026-07-10T12:00:00.000Z",
    "countdownPage": true
  }'

Update a short link

PATCH /public/v1/short-links/{shortLinkId}

Send at least one field to update. Scheduling fields require a Pro or Business plan.

Example

curl -X PATCH https://api.to.it.com/v1/short-links/SHORT_LINK_ID \
  -H "Authorization: Bearer toit_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"countdownPage": true, "startsAt": "2026-07-10T12:00:00.000Z"}'

List short links

GET /public/v1/short-links

Optional query parameter: profileId (uuid) to filter by profile.

Get a short link

GET /public/v1/short-links/{shortLinkId}

Returns the short link record and computed shortUrl.

Response fields

Create, list, get, and patch responses include the full short link object. Notable scheduling fields:

Owner API responses include targetUrl and hasPassword. They never include passwordHash or the plain-text password.

CAPTCHA-protected links

When captchaEnabled is true:

• Visitors must complete a Cloudflare Turnstile challenge before the destination URL is revealed.
• The public resolve endpoint does not return targetUrl until all gates are cleared.
• Gate order is always captcha → password → countdown → redirect. Captcha runs first when enabled; passwordBeforeCountdown still only orders password vs countdown.
• After a successful CAPTCHA, the API sets an HttpOnly unlock cookie (toit_sl_captcha_{id}) so visitors are not challenged again during the same visit (separate from the password unlock cookie).
• Verify via POST /public/short-link-verify-captcha with { shortLinkId, turnstileToken }.

Requirements:

• Available on all plans, including Free.
• Requires a valid Cloudflare Turnstile token verified server-side.

Password-protected links

When password is set on create or patch:

• Visitors must enter the password before the destination URL is revealed.
• The public resolve endpoint does not return targetUrl until all gates (captcha, password, countdown) are cleared.
• After a correct password, the API sets an HttpOnly unlock cookie so visitors are not prompted again during the same visit.
• Use clearPassword: true on patch to remove protection.

Requirements:

• Requires Pro or Business (passwordLinks plan feature).
• Password length: 4–128 characters.
• Combine with countdown pages using passwordBeforeCountdown to control password vs countdown order (captcha always comes first when enabled).

Countdown pages

When countdownPage is true and startsAt is in the future:

• Visitors who open the short URL see a live countdown (days, hours, minutes, seconds) instead of a 404.
• When the countdown reaches zero, they are redirected automatically to targetUrl.
• Click analytics are recorded on redirect, not when the countdown page loads.
• title and description are shown on the countdown page when set.

Requirements and rules:

• Requires Pro or Business (same plan gate as link scheduling).
• countdownPage: true requires startsAt to be set.
• Clearing startsAt (null) also clears countdownPage.
• After startsAt has passed, the link redirects normally even if countdownPage remains true.

OpenAPI

See the full interactive API reference generated from our OpenAPI spec.