What the API covers
Creating and updating links and their destinations, generating QR artwork, reading scan analytics, and subscribing to webhooks. The specification is published as OpenAPI and rendered server-side at the docs page, so the operations, parameters and error shapes are readable without running anything.
The parts that matter to a backend
Every POST accepts an idempotency key, so a retry after a timeout does not create a second link. Errors follow RFC 7807 problem details rather than an ad-hoc envelope, so one handler can read every failure the API produces.
Webhook deliveries are signed with HMAC-SHA256 using a per-subscription secret, and delivery history keeps the status, response code and both bodies, so a failed delivery can be diagnosed rather than guessed at.
Authentication is a Bearer token from an API key you mint in settings, scoped to the operations it needs, with its own rate limit and an optional IP allowlist. OAuth 2.0 is available for applications acting on another workspace behalf.
Which plans include it
API access is on every plan, including the free one. What varies by tier is how many keys and webhook subscriptions you may hold and the request allowance; the plan comparison has the exact figures.