REST API Documentation

API Documentation

Use the xlnk.dk API to programmatically shorten URLs, create self-destructing messages, and generate passwords. All API endpoints require an API key.

OpenAPI Spec Postman Collection

Get an API Key

Your email is stored for contact purposes only.

Authentication

Include your API key in every request using either method:

                    # Header (recommended)

                    X-Api-Key: xlnk_your_key_here

                    # POST parameter

                    api_key=xlnk_your_key_here

Shorten URL

POST /

Parameter	Description
`url`	The URL to shorten (required, http/https)
`json`	Set to any value to get JSON response (required for API)
`api_key`	Your API key (or use `X-Api-Key` header)

                    # Example

                    curl -X POST https://xlnk.dk/ \

                      -H "X-Api-Key: xlnk_your_key" \

                      -d "url=https://example.com/very/long/url&json=1"

                    # Response

                    {"url":"https://xlnk.dk/ab12","code":"ab12","safe_browsing":"passed"}

Create Secret

POST /secret/

Messages must be encrypted client-side with AES-256-GCM before submission. The server stores only ciphertext — zero-knowledge.

Parameter	Description
`ciphertext`	Base64-encoded encrypted message
`iv`	Base64-encoded initialization vector (12 bytes)
`expires`	`1h` \| `24h` \| `7d` \| `30d` (default: 24h)

                    # Example

                    curl -X POST https://xlnk.dk/secret/ \

                      -d "ciphertext=BASE64_DATA&iv=BASE64_IV&expires=24h"

                    # Response

                    {"code":"abc123...","url":"https://xlnk.dk/secret/abc123..."}

Reveal Secret

POST /secret/reveal

Retrieves and permanently deletes the secret. The response contains the ciphertext for client-side decryption.

Parameter	Description
`code`	The 32-character hex secret code

                    # Example

                    curl -X POST https://xlnk.dk/secret/reveal \

                      -d "code=abc123..."

                    # Response

                    {"ciphertext":"BASE64_DATA","iv":"BASE64_IV"}

Generate Password

GET /api/password

Generate cryptographically secure random passwords server-side. Unlike the /password web tool (which runs entirely in your browser), this endpoint generates passwords on the server and returns them over the wire. For added security, request multiple passwords (e.g. count=50) and select one at random on the client — this way the server cannot know which password you actually use.

Parameter	Description
`length`	Password length, 4–128 (default: 20)
`letters`	`1` or `0` — include a–z, A–Z (default: 1)
`numbers`	`1` or `0` — include 0–9 (default: 1)
`symbols`	`1` or `0` — include special characters (default: 0)
`count`	Number of passwords, 1–100 (default: 1)

                    # Example

                    curl "https://xlnk.dk/api/password?length=24&symbols=1&count=3"

                    # Response (single)

                    {"password":"aB3kL9mNpQrStUvWxYz1"}

                    # Response (multiple)

                    {"passwords":["aB3kL9...","xYz1Qw...","mNpRsT..."]}

Generate GUID

GET /api/guid

Generate cryptographically secure random version 4 UUIDs (RFC 4122). Unlike the /guid web tool (which runs entirely in your browser), this endpoint generates GUIDs on the server.

Parameter	Description
`count`	Number of GUIDs, 1–25 (default: 1)

                    # Example

                    curl "https://xlnk.dk/api/guid?count=5"

                    # Response (single)

                    {"guid":"550e8400-e29b-41d4-a716-446655440000"}

                    # Response (multiple)

                    {"guids":["550e8400-...","6ba7b810-...","f47ac10b-..."]}

Rate Limits

POST requests	10 per minute per IP
Burst allowance	5 additional requests
Max URL length	2,048 characters
Max message size	~10,000 characters
Rate limit response	`429 Too Many Requests`

Error Responses

All errors return JSON with an error field:

{"error":"Invalid or missing API key. Get one at /api"}

Code	Description
`400`	Missing or invalid parameters
`401`	Invalid or missing API key
`404`	Secret not found or already viewed
`429`	Rate limit exceeded