One POST request returns a short link that stops resolving the moment it expires. No signup, no OAuth, no SDK — just your RapidAPI key and an HTTP client. Here is the entire integration:
POST /api/shorten
Host: url-shortner26.p.rapidapi.com
Content-Type: application/json
X-RapidAPI-Key: YOUR_KEY
{
"url": "https://example.com/a-very-long-link",
"expiresIn": 86400
}201 Created
{
"shortUrl": "https://link.twotic.dev/u/k7m2xqp",
"shortCode": "k7m2xqp",
"longUrl": "https://example.com/a-very-long-link",
"expiresAt": "2026-07-20T14:32:07.000Z",
"analyticsUrl": ".../api/analytics/k7m2xqp",
"reused": false
}Two endpoints, documented honestly. Every feature below maps to something you can verify in the response.
Every link carries a TTL — 24 hours by default, anything from a minute to 30 days via expiresIn. Past its expiry the link stops resolving and the destination is never disclosed, so temporary links stay temporary with no cleanup work on your side.
Each redirect increments an atomic counter. Query GET /api/analytics/:code for click count, last-clicked timestamp, creation time and expiry — scoped so you only ever see your own links.
POST a JSON body with your RapidAPI key and read the short URL out of the response. No OAuth dance, no account creation, no SDK to install.
A closed allowlist accepts http and https only, and rejects private, loopback and link-local hosts. javascript: and data: URIs never become links, so your short domain never becomes an XSS vector.
Shorten the same URL twice and you get the same code back, scoped to your key. Retries are safe and your quota is not spent on duplicates.
Two endpoints, JSON in and JSON out, standard status codes. If your language can make an HTTP request, it can use this API.
From zero to a working short link in about a minute.
Pick the free tier. You get a key immediately — no card, no sales call.
One request with your key in the header and the URL in the body.
Read shortUrl from the response. Poll the analytics endpoint whenever you want click counts.
curl -X POST 'https://url-shortner26.p.rapidapi.com/api/shorten' \
-H 'Content-Type: application/json' \
-H 'X-RapidAPI-Key: YOUR_KEY' \
-d '{"url":"https://example.com/a-very-long-link","expiresIn":86400}'const res = await fetch(
"https://url-shortner26.p.rapidapi.com/api/shorten",
{
method: "POST",
headers: {
"Content-Type": "application/json",
"X-RapidAPI-Key": process.env.RAPIDAPI_KEY,
},
body: JSON.stringify({
url: "https://example.com/a-very-long-link",
expiresIn: 86400, // 24 hours
}),
}
);
const { shortUrl, expiresAt } = await res.json();
console.log(shortUrl); // https://link.twotic.dev/u/k7m2xqpimport os, requests
res = requests.post(
"https://url-shortner26.p.rapidapi.com/api/shorten",
headers={
"Content-Type": "application/json",
"X-RapidAPI-Key": os.environ["RAPIDAPI_KEY"],
},
json={
"url": "https://example.com/a-very-long-link",
"expiresIn": 86400, # 24 hours
},
)
print(res.json()["shortUrl"]) # https://link.twotic.dev/u/k7m2xqp$ch = curl_init("https://url-shortner26.p.rapidapi.com/api/shorten");
curl_setopt_array($ch, [
CURLOPT_POST => true,
CURLOPT_RETURNTRANSFER => true,
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"X-RapidAPI-Key: " . getenv("RAPIDAPI_KEY"),
],
CURLOPT_POSTFIELDS => json_encode([
"url" => "https://example.com/a-very-long-link",
"expiresIn" => 86400,
]),
]);
$data = json_decode(curl_exec($ch), true);
echo $data["shortUrl"];A permanent link is a liability when the thing it points to was only ever meant to be temporary.
Auth links should not outlive the session they authorise. Set expiresIn to match your token lifetime so a forwarded email is a dead link rather than an open door.
Generate a short link inside a chatbot, CRM or helpdesk macro without making the agent leave the tool, and see afterwards whether it was actually clicked.
160 characters is unforgiving. A seven-character code buys back room for copy, and the click counter tells you which send worked.
Share a preview that stops resolving after the review window closes, so an old link in a Slack thread cannot leak a build months later.
Billing, keys and quotas are handled by RapidAPI. Current tiers and limits are always live on the listing.
$0/month
Everything working end to end, at no cost. No card required.
$60/month
For production apps past the free allowance.
$120/month
Ten times cheaper per overage request than Pro.
$180/month
Highest included allowance for high-volume workloads.
Included request quotas are shown live on the RapidAPI listing, which is always the authoritative source.
Compare plans on RapidAPIYes. The free tier on RapidAPI covers a monthly quota of shortened links with no card required, which is enough for prototypes, side projects and low-volume production use. Paid tiers raise the quota if you outgrow it.
24 hours by default. You can set any lifetime between 60 seconds and 30 days by passing expiresIn (in seconds) with your request. Once a link expires it stops resolving immediately and its destination is never disclosed.
No account on this site is needed. You subscribe on RapidAPI, which issues your API key, and authentication is that key in a request header. There is no OAuth flow and no separate registration step.
Yes. Every redirect increments a counter atomically. Call GET /api/analytics/{code} with your key to get the total click count, the last-clicked timestamp, when the link was created and when it expires.
They are redirected to a page explaining the link is no longer available. The original destination is never disclosed, so an expired link leaks nothing about where it pointed.
Anything that is not http or https, plus private, loopback and link-local addresses. This blocks javascript: and data: URIs, which would otherwise turn a short link into a cross-site scripting vector.
Yes. It is a plain REST API that takes and returns JSON, so any language with an HTTP client works. RapidAPI also generates ready-to-paste snippets for over a dozen languages.
Links are scoped to your API key. Analytics for a code are only readable by the key that created it, and shortening the same URL from a different key produces a different code.
Subscribe on RapidAPI, copy your key, make one request. If it does not fit your use case you have lost about a minute.