ShortFreeURL for Developers
A REST API, signed webhooks and a redirect path that stays boring.
If you are integrating a link platform you care about three things: whether the API is complete, whether the redirect path is fast and independent of the dashboard, and whether you can get your data out. This page covers those directly.
A complete REST API
Links, folders, domains, bundles, posts, QR codes and reporting are all addressable through the API with token authentication. There is no reduced feature set for API-created links — targeting rules, expiry, passwords, UTM values and A/B configuration are all settable programmatically.
Rate limits are published rather than discovered, and bulk endpoints exist so creating thousands of links does not mean thousands of requests.
- Token auth with published rate limits
- Full feature parity with the dashboard
- Bulk create and bulk update endpoints
- Stable identifiers for joining to your own data
Webhooks over polling
Click events are delivered to your endpoint as they happen, signed so you can verify origin, and retried on failure so a deployment window on your side does not lose events. The payload carries the fields you would otherwise have to reconstruct: link, timestamp, resolved geography, device, referrer and campaign parameters.
Where a pull model is a better fit, the reporting endpoints expose the same aggregates the dashboard renders, and raw events export as CSV for backfill.
- Signed webhook payloads with retry
- Per-click geography, device, referrer and campaign fields
- Reporting endpoints for scheduled pulls
- CSV export of raw events
Redirect behaviour you can reason about
Redirects are served from a cache-first path that is separate from the dashboard application, so a lookup does not depend on the main app being healthy. You choose the status code per link, folder or domain — 301, 302, 307 or 308 — which matters when a link sits in front of a POST endpoint or when caching behaviour has to be explicit.
Cloaking, referrer hiding and encrypted destinations are available where the default behaviour is not what you want.
- Cache-first redirect path independent of the dashboard
- 301, 302, 307 or 308 per link, folder or domain
- Cloaking and referrer hiding as explicit options
- Encrypted destinations decrypted client-side
Attribution as a join key
Conversion tracking works by passing a click identifier through the redirect. Your application reports back server-side when the visitor converts, with an optional value, and the event is joined to the original click and its campaign context.
This is deliberately a server-side mechanism rather than a client-side pixel, which makes it usable from a backend, a mobile app or a job that reconciles orders after the fact.
- Click identifier passed to the destination
- Server-side conversion reporting with a value
- Works for QR scans and clicks identically
- Attribution by link, folder, campaign and domain
Tooling around the API
There is a browser extension, mobile apps and a command-line tool for the cases where a request would be overkill, plus integrations with Zapier, Make, Slack, WordPress, GitHub Actions and MCP.
Import and export cover CSV and XLSX in both directions with a dedicated Bitly migration path, so moving in or out is a supported operation rather than a scraping exercise.
- CLI, browser extension and mobile apps
- Zapier, Make, Slack, WordPress, GitHub Actions and MCP
- CSV and XLSX import and export
- Bitly migration preserving short codes
Access control and environments
Teams separate environments and product lines, each with its own domains and folders. Roles run from owner to read-only, per-link permissions protect production links from casual edits, and SAML 2.0 single sign-on ties account access to your identity provider.
API tokens are scoped to a team, so a job that manages staging links cannot reach production ones.
- Team-scoped API tokens
- SAML 2.0 SSO and granular roles
- Per-link permissions on production links
- Separate domains per environment
Questions
What is the API rate limit?
It is published rather than negotiated, and bulk endpoints exist so high-volume work does not need to be done one request at a time.
Are webhooks retried?
Yes, and they are signed so you can verify origin before processing.
Can I choose the HTTP status code?
Yes, per link, folder or domain — 301, 302, 307 or 308.
Is conversion tracking client-side?
No. A click identifier is passed through the redirect and your server reports the conversion back, which makes it usable from backends and mobile apps.
Can I migrate links from another shortener?
Yes, via CSV or XLSX import, with a dedicated Bitly path that preserves existing short codes.
Does the redirect path depend on the dashboard being up?
No. Redirects are served from a separate cache-first path so they keep resolving during dashboard maintenance.
Read the API docs and create your first link from a terminal.
Start Free — no credit card
The free plan includes 1,000 links, 6 custom domains and 50,000 tracked clicks a month, free forever. Choose a free subdomain from six shared domains. Paid plans start at $4 a month when you outgrow it, and you keep everything you have built.