Short.io
MARKETING · MARKETING
Branded short links, folders, tags and QR codes under their own API key.
Connecting Short.io in practice
Short.io publishes a separate rate limit per endpoint rather than one account limit: 20 requests a second to read or update a link, 50 for the GET create shortcut, 1 a second for bulk delete, and 5 requests per 10 seconds for the bulk create that takes 1,000 links at a time. That bulk create is explicitly not transactional — it can insert some links and return an error object in place of the others in the same array.
Scopes that draw scrutiny
Authorization: <secret API key>The raw key goes in the Authorization header with no Bearer prefix. A secret key is restricted at creation to a specific team or domain, and that restriction is the only scoping available.Public API keyCreated by enabling the Public key option. It is the only credential meant for client-side use and only works with POST /links/public, so shipping a secret key in a browser app is the mistake this exists to prevent.
Rate limits
- Read and update a link: 20 requests per second (GET /links/{linkId}, GET /links/expand, POST /links/{linkId}, DELETE /links/{linkId}, POST /links/public).
- GET /links/tweetbot, the simple create endpoint: 50 requests per second.
- DELETE /links/delete/bulk: 1 request per second.
- POST /links/bulk: 5 queries in 10 seconds, each accepting up to 1,000 links — so roughly 500 links a second at the ceiling.
Worth knowing
- POST /links/bulk is not transactional: the response is an array where each element is either a Link object or an error object, so partial success has to be reconciled element by element rather than by status code.
- A key scoped to one team or domain cannot touch links on another, so a multi-domain account needs one credential per domain and the agent has to know which key goes with which host.
- GET /links/by-original-url is marked DEPRECATED in favour of GET /links/multiple-by-url, which returns every link sharing that destination rather than one.
- Archiving is not deleting: an archived short link is only hidden from the dashboard and keeps resolving, so "cleaned up" links are still live redirects.
Checked against Creating an API key (2026-09-29), High volume short link creation (2026-09-29), Create up to 1000 links in one call (2026-09-29)
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Often connected alongside
Put Short.io behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.