RESTful API for the LinkPulse URL shortener. All endpoints accept and return JSON. Authentication is handled via session cookies (Auth.js).
/api/auth/registerPublicRegister with email, name, and password. Passwords are hashed with bcrypt (12 rounds).
{
"name": "Jane Doe",
"email": "jane@example.com",
"password": "StrongPass1",
"confirmPassword": "StrongPass1"
}{
"message": "Account created successfully",
"user": {
"id": "clx...",
"name": "Jane Doe",
"email": "jane@example.com",
"createdAt": "2026-01-01T00:00:00.000Z"
}
}/api/links🔒 Auth requiredGenerates a short URL with optional custom slug, title, expiration, click limit, and password protection.
{
"url": "https://example.com/very-long-url",
"slug": "demo",
"title": "Demo Link",
"expiresAt": "2026-12-31T23:59:59Z",
"maxClicks": 1000,
"password": "optional-password"
}{
"id": "clx...",
"url": "https://example.com/very-long-url",
"slug": "demo",
"shortUrl": "https://bossiq-linkpulse.vercel.app/demo",
"clicks": 0,
"isActive": true,
"createdAt": "2026-01-01T00:00:00.000Z"
}/api/links🔒 Auth requiredReturns a paginated, searchable list of the user's shortened links with click counts.
{
"links": [
{
"id": "clx...",
"url": "https://example.com",
"slug": "demo",
"title": "Demo Link",
"clicks": 42,
"isActive": true,
"createdAt": "2026-01-01T00:00:00.000Z"
}
],
"pagination": {
"page": 1,
"limit": 20,
"total": 1,
"totalPages": 1
}
}/api/links/:id🔒 Auth requiredPermanently removes a link and all associated click data. Owner verification enforced — returns 403 if the link belongs to another user.
{ "success": true }/api/links/:id/qr🔒 Auth requiredReturns a QR code image for the short URL. Supports SVG (default) and PNG formats via the "format" query parameter. Size configurable via "size" (default 256).
Binary image data (SVG or PNG)/[slug]PublicPerforms a 301 redirect to the original URL. Logs click analytics (device, browser, OS, referrer, IP) asynchronously without blocking the redirect. Checks expiration, click limits, and active status.