Clicking is fine for one link. When you need fifty, or a script that syncs links from somewhere else, the API does everything the dashboard does — same validation, same limits, same permissions — over plain JSON.
Get a token
In the console, open My Profile → API tokens and create one. You'll see the token exactly once; the dashboard only ever stores its hash. Tokens come in two flavors:
- Full access — can read and write.
- Read-only — can list and fetch, but every write is rejected. Right for dashboards and scripts that should never change anything.
A token can only see and touch what its owning account could in the browser — nothing is wider, and revoking it cuts the script off instantly.
The shape of it
Every request carries Authorization: Bearer <token>. The endpoints are plain REST on /api/redirects.php:
- GET — list redirects (with filters and pagination), or fetch one by id.
- POST — create one, or pass {"bulk": [...]} to create up to 100 in a call; each item reports its own success or failure.
- PUT / PATCH — update only the fields you send.
- DELETE — remove a link and its history.
The full API reference lists every field, including schedules, split tests, and SEO meta.
Where scripts shine
- Import day — migrate a spreadsheet of links in one bulk call and get a per-row result report.
- Sync from elsewhere — a cron that mirrors links from a CMS or spreadsheet on any change.
- Rotating links — flip a destination programmatically when inventory or content changes.
Scripts are rate-limited per token to keep things polite, and every write lands in the activity log marked "(via API token)" — so you can always tell a script's changes from a human's.