Authentication
Every API call sends your app's API key in the Api-Key header; errors answer with their status and a JSON message.
API keys
Send your app's key in the Api-Key header on every call:
curl https://dev.thedbl.ink/api/links/1001 -H 'Api-Key: YOUR_API_KEY'A key stands for one app. It creates links in that app, and reads, updates, deletes and resolves only that app's links. A missing or unknown key, or the key of a deleted app, answers 401.
An app has two kinds of key:
- Live: for your production backend and release builds.
- Sandbox: starts with
sandbox_, for your sandbox backend and test builds. Its links are sandbox links, and it can't change live links.
You generate both on your app's page in the dashboard, which shows each key once. Generating a key again replaces the previous key of that kind.
Errors
An error answers with its HTTP status. A 400, 403 or 404 also carries a JSON body that says what went wrong, and a 401 has an empty body:
{ "message": "Max links reached for subscription. Please upgrade to re-enable usage." }| Status | Meaning |
|---|---|
| 400 | The body is missing a field or isn't valid, a short code is taken, or the month's links are used up. |
| 401 | The key is missing, unknown or belongs to a deleted app. |
| 403 | The link belongs to another app. |
| 404 | The link doesn't exist or isn't one of your app's, or a sandbox key tried to change a live link. |
Calling from a browser
The API answers cross-origin requests from any website, and it reads only the Api-Key header, never cookies. That's what lets the API reference send requests from this site. In your own web pages, use a key that's fine to be seen, because anything sent from a browser is visible to its user.