Your codes, in your workflow.

Business access

Create a key in dashboard settings on an active Business plan. The full qf_ key is shown once and stored only as a SHA-256 hash. Keep it server-side, outside public repositories and browser code. Revoke it from settings to remove access immediately. Cookie authentication is never used for /api/v1 routes.

Authentication and limits

Send Authorization: Bearer qf_YOUR_KEY. Each key allows 600 requests per hour. A rate limit returns 429. Invalid keys return 401, an inactive Business plan returns 403 and account-owned code lookups return 404 for other accounts. Plan capacity returns 402 over_limit. Codes above a downgraded allowance remain redirecting and become read-only.

curl 'https://qrforever.wouldairecommend.workers.dev/api/v1/codes' \
  -H 'Authorization: Bearer qf_YOUR_KEY'

Create a code

curl 'https://qrforever.wouldairecommend.workers.dev/api/v1/codes' \
  -H 'Authorization: Bearer qf_YOUR_KEY' \
  -H 'Content-Type: application/json' \
  -d '{"name":"Menu","destination":"https://example.com/menu"}'

Success returns 201 with a code object: id, slug, name, destination, status, created_at and updated_at. The short URL is this service’s origin followed by /q/ and the case-sensitive slug. Only public HTTP and HTTPS hostnames without credentials are accepted; IP literals, local hosts and our own redirect URLs are rejected.

Routes

GET, POST           /api/v1/codes
GET, PATCH, DELETE  /api/v1/codes/ID
GET                 /api/v1/codes/ID/stats?days=30

List returns codes with 30-day totals and daily series. GET by ID returns {code}. PATCH accepts name, destination and status (active or paused). DELETE permanently removes the code and scan history, returning {ok:true}; printed copies stop working. Abuse-disabled codes cannot be reactivated by API.

Edit and read statistics

curl -X PATCH 'https://qrforever.wouldairecommend.workers.dev/api/v1/codes/CODE_ID' \
  -H 'Authorization: Bearer qf_YOUR_KEY' \
  -H 'Content-Type: application/json' \
  -d '{"destination":"https://example.com/new-menu"}'

curl 'https://qrforever.wouldairecommend.workers.dev/api/v1/codes/CODE_ID/stats?days=90' \
  -H 'Authorization: Bearer qf_YOUR_KEY'

Statistics return days, total, series [{day,count}], countries, devices and os [{name,count}]. The window is clamped to 1–730 days on Business. Daily series include zero-scan days. Counts represent aggregate redirect requests rather than unique visitors. Known bots and HEAD requests are excluded.

Bulk import and reports

The dashboard accepts CSV with exact headers name,destination, up to 500 rows per import. Quoted commas and newlines are supported. All rows validate before a single atomic insert. Bulk and API-key management are dashboard endpoints, not additional /api/v1 routes. To report suspected abuse, POST /api/report with {slug,reason}; the public route is limited to five reports per hour per caller.

Errors and privacy

Errors use JSON with error and message fields. Handle non-2xx status codes before using a result; do not retry invalid destinations. There are no scanner identities or raw IP addresses in scan exports. Account exports and deletion are available in dashboard settings.