Zynko API documentation

Use the production API base URL below. All request and response bodies use JSON. Send requests over HTTPS.

Quick setup: Sign in to your Zynko publisher account, generate an API key, store it as a server-side secret, then call the create-link endpoint.

Never put your API key in browser JavaScript, mobile app bundles, public repositories or client-side environment variables.

The API uses a personal API key with the HTTP Bearer authentication scheme. Include the key in the Authorization header on every API request.

Authorization: Bearer YOUR_ZYNKO_API_KEY
Content-Type: application/json

Keys begin with lv_live_. Generate, rotate and revoke keys from the signed-in API documentation page. The complete key is shown only once immediately after generation; only its prefix is stored for later display.

Rotating a key replaces the previous key. Revoking it immediately makes requests using that key return 401 Unauthorized.

Create a short link owned by the publisher account associated with the API key.

Request body

{
  "url": "https://example.com/article",
  "customCode": "my-link",
  "expiresAt": "2027-01-01T00:00:00.000Z"
}

Successful response · 201 Created

{
  "code": "my-link",
  "shortUrl": "https://linkveda-shortner.vercel.app/my-link",
  "destinationHost": "example.com"
}

Fetch basic public metadata for an existing short code. Replace :code with the short code.

GET https://linkveda-api.onrender.com/api/links/my-link

{
  "code": "my-link",
  "destinationHost": "example.com",
  "status": "active",
  "expiresAt": null,
  "clicks": 12,
  "createdAt": "2026-01-01T12:00:00.000Z"
}

This lookup returns metadata only; it does not reveal the full destination URL. A missing code returns 404. The short-link redirect itself may return 410 Gone when disabled or expired.

All management endpoints below require the same Bearer API key and operate only on links owned by that publisher account.

curl "https://linkveda-api.onrender.com/api/v1/links?page=1&limit=20" -H "Authorization: Bearer YOUR_ZYNKO_API_KEY"

{
  "status": "disabled"
}

curl -X PATCH "https://linkveda-api.onrender.com/api/v1/links/my-link" -H "Authorization: Bearer YOUR_ZYNKO_API_KEY" -H "Content-Type: application/json" -d '{"status":"disabled"}'

curl -X DELETE "https://linkveda-api.onrender.com/api/v1/links/my-link" -H "Authorization: Bearer YOUR_ZYNKO_API_KEY"

Analytics are scoped to links owned by the API-key account. Click data includes totals, daily activity for the last 30 days, countries, devices and browsers.

curl "https://linkveda-api.onrender.com/api/v1/analytics" -H "Authorization: Bearer YOUR_ZYNKO_API_KEY"

curl "https://linkveda-api.onrender.com/api/v1/links/my-link/analytics" -H "Authorization: Bearer YOUR_ZYNKO_API_KEY"

Analytics response fields: totalClicks, validClicks, daily, countries, devices and browsers. Per-link analytics also includes the link summary.

Omit optional fields when they are not needed. If customCode is omitted, the service generates a short code automatically.

curl -X POST "https://linkveda-api.onrender.com/api/v1/links" \  -H "Authorization: Bearer YOUR_ZYNKO_API_KEY" \  -H "Content-Type: application/json" \  -d '{"url":"https://example.com/article","customCode":"my-link"}'

Install the relevant HTTP client if required. Keep the API key in a server-side environment variable named ZYNKO_API_KEY.

Send a real request to the production endpoint. Each successful test creates an actual short link in your publisher account.

Checking your account…

The key is held temporarily in this page and sent to the API endpoint for this request. Use this tester only on a trusted device; never share this page while a key is entered.

Successful responses use JSON. Validation and application errors return JSON; rate-limit responses may be plain text depending on the limiter response. Successful creation returns 201. Common errors:

Error response example:

{
  "error": "This short code is already in use."
}

Validation errors may also include a details object with field-level information.

The API-key create-link endpoint is limited to 60 requests per hour. A global API limit of 120 requests per minute also applies. The server rate limiter applies these limits using its configured client identity; they are not per-account quotas.

Rate-limit headers may include RateLimit-Policy and RateLimit. When you receive HTTP 429, stop retrying immediately and wait before sending more requests. Do not assume an exact reset timestamp unless a response header provides one.

Request bodies are limited to 32 KB JSON by the API server.

• Keep API keys on your server in environment variables or a secrets manager.
• Never expose keys in frontend JavaScript, browser storage, source maps, screenshots or public Git repositories.
• Use HTTPS and send API calls from your backend.
• Rotate a key immediately if it may have been exposed.
• Use a unique custom code only when you need a predictable short URL.
• Only send destinations you own or are authorized to shorten. Private/local network destinations and URLs containing embedded credentials are rejected.
• Build retry logic with backoff for temporary network failures; do not repeatedly retry 400, 401 or 409 responses unchanged.