Quick Shorten API, Flyn API Documentation

A simplified endpoint for quickly shortening URLs. Works with or without authentication. Anonymous links expire in 48 hours.

When to use this vs /api/links

Use /api/shorten when you just need a short URL quickly. Use /api/links when you need full control over tags, OG metadata, targeting, passwords, and other advanced features.

Shorten a URL

POST/api/shorten

Request Body

Parameter	Type	Required	Description
url	string	Yes	The URL to shorten (max 2048 characters)
slug	string	No	Custom slug (letters, numbers, hyphens, underscores)
domain	string	No	Custom domain (must be verified). Defaults to "www.flyn.to".
tags	string[]	No	Tags for organizing (only saved for authenticated requests)

Authentication

This endpoint works both with and without authentication:

Mode	Rate Limit	Daily Limit	Link Expiry
Anonymous	5 req/min	5 links/day	48 hours
Authenticated	30 req/min	Unlimited	Never (unless set)

Anonymous Request

curl -X POST https://www.flyn.to/api/shorten \
  -H "Content-Type: application/json" \
  -d '{ "url": "https://example.com/very-long-url" }'

Authenticated Request

curl -X POST https://www.flyn.to/api/shorten \
  -H "Authorization: Bearer flyn_sk_live_..." \
  -H "Content-Type: application/json" \
  -d '{ "url": "https://example.com/very-long-url", "slug": "my-link" }'

Response (200)

Field	Type	Description
id	string	Link UUID
slug	string	The short slug
shortUrl	string	Full short URL ready to share
expiresAt	string \| null	ISO 8601 expiration (48h for anonymous, null for authenticated)
authenticated	boolean	Whether the request was authenticated

Response Example

{
  "id": "a1b2c3d4-...",
  "slug": "xK9f2R",
  "shortUrl": "https://flyn.to/xK9f2R",
  "expiresAt": "2026-04-01T14:30:00.000Z",
  "authenticated": false
}

Rate Limit Headers

Every response includes rate limit information:

Field	Type	Description
X-RateLimit-Limit	number	Maximum requests per window
X-RateLimit-Remaining	number	Remaining requests in current window
X-RateLimit-Reset	number	Seconds until the rate limit window resets

URL Deduplication

For anonymous users, if the same URL is shortened within a 5-minute window, the existing short link is returned instead of creating a duplicate. This prevents abuse and saves resources.

Bot Protection

Anonymous requests go through additional bot detection checks:

A valid User-Agent header is required (minimum 10 characters)
An Accept header is required
Known bot user agents (curl, wget, python-requests, etc.) are blocked for anonymous requests
Authenticated API requests bypass bot detection entirely

Progressive Rate Limiting

Exceeding the rate limit triggers progressive cooldown penalties:

Offense	Cooldown
1st	1 minute
2nd	5 minutes
3rd	15 minutes
4th+	1 hour