Build on 2xurl.

• Each key has a per-minute limit and each workspace a monthly request quota, both set by your plan.
• Responses carry X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset (seconds), plus X-Quota-Limit and X-Quota-Remaining.
• Over a limit you get 429 rate_limited with a Retry-After header. Wait that many seconds before retrying.
• Send an Idempotency-Key header on POST, PATCH and PUT requests so a retried request is not applied twice.

Errors use standard HTTP status codes and one JSON shape:

{
  "error": { "code": "slug_taken", "message": "That back-half is already in use", "details": null },
  "requestId": "a9116b45-2fbb-4e09-a359-5f3874e7dfe8"
}

Include the requestId when you contact support about a failed request.

Lists return up to 25 items by default and at most 100 (limit). Cursor-paginated lists answer with data, hasMore and nextCursor; pass cursor=nextCursor to get the next page.

{ "data": [ ... ], "hasMore": true, "nextCursor": "clx8k2..." }

Create fields: destinationUrl (required), slug, domainId, title, description, folderId, campaignId, tagIds, password, redirectStatus, activeFrom, expiresAt, expiredUrl, maxClicks, and utmSource / utmMedium / utmCampaign / utmTerm / utmContent. Dates are ISO 8601.

curl -X POST https://2xurl.com/api/v1/links \
  -H "Authorization: Bearer 2x_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{
    "destinationUrl": "https://example.com/summer-sale",
    "slug": "summer",
    "utmSource": "newsletter",
    "expiresAt": "2026-12-31T23:59:59Z"
  }'

The response is the link, including id, slug, shortUrl, clickCount, uniqueCount, hasPassword and tags. Counts are returned as strings.

Coming soon. Custom domains are paused while we finish and test them; these endpoints are listed for reference and may refuse requests until then.

A domain must be verified before links can use it; otherwise you get domain_not_verified.

Common query parameters: from, to (ISO dates), tz (IANA time zone such as Asia/Kolkata), linkId, domainId. breakdown takes a dimension: country, device, browser, os, referrer, utm_source, utm_medium, utm_campaign or source.

curl "https://2xurl.com/api/v1/analytics/breakdown?dimension=country&linkId=LINK_ID&from=2026-10-01&to=2026-10-16" \
  -H "Authorization: Bearer 2x_your_key_here"

Events: link.created, link.updated, link.deleted, domain.verified, workspace.member_invited, workspace.member_joined.

• Each delivery is a JSON POST with headers X-2xurl-Event, X-2xurl-Delivery and X-2xurl-Signature.
• The signature is sha256= followed by the HMAC-SHA256 of the raw body, keyed with your webhook secret.
• Answer with a 2xx status. Failed deliveries are retried up to 6 times with exponential backoff; a webhook that keeps failing is disabled automatically.

See the webhooks guide for a verification example.

Questions about the API? Email [email protected] with the requestId of the request, or check the Status page if something looks down.