# u4.nz

> URL shortener. Paste a long link, get a short one at https://u4.nz/<slug>. Anonymous links need no account and never expire. Accounts add custom slugs, expiry dates, click stats and a bearer-token API.

Short links redirect with a 302 from Cloudflare's edge. Add `+` to any short link to see where it goes without following it (https://u4.nz/<slug>+). Every link has a QR code at https://u4.nz/<slug>.qr.svg.

## API

- [OpenAPI 3.1 spec](https://u4.nz/openapi.json): machine-readable description of every endpoint
- [API reference](https://u4.nz/docs): the same, for people

Base URL https://u4.nz. Auth: `Authorization: Bearer u4_…` (token from the dashboard). Bodies may be JSON or form-encoded; responses are JSON.

- POST /api/links — create. Fields: url (required), slug (optional), expires (days, optional). Returns 201 with slug, short, qr, url, created_at, expires_at, clicks.
- POST /api/links/bulk — up to 100 at once, {"links":[{"url":…}]}. Returns 207 with per-item results.
- GET /api/links?limit=100 — list, newest first.
- GET /api/links/{slug} · PATCH (url, expires) · DELETE
- GET /api/links/{slug}/stats?days=30 — clicks by day, country, referrer, device.
- GET /api/links/{slug}/clicks.csv — raw click rows, last 90 days.
- GET /api/me — account and totals.

Errors are {"error":"…"} with 400 (bad input), 401 (bad token), 403 (blocked destination), 404, 409 (slug taken), 429 (600 req/min).

## Rules

- Destinations must be http or https to a public host. No private hosts, raw IPs, or u4.nz itself.
- Slugs: 4–64 chars, letters, digits, - and _ (shorter ones are not available). A reserved list (site paths, brand names phishers use, profanity) can't be registered; it reads as "taken".
- No malware, phishing, or links that lie about where they go. Links that break the terms are removed and serve 410.

## Optional

- [Terms](https://u4.nz/terms)
- [Privacy](https://u4.nz/privacy): per click we keep time, country, referring site, and device class. No IPs, no cookies for visitors. Account activity and API requests are logged with the caller's IP.