Basics
Send request bodies as JSON with Content-Type: application/json. Every response is JSON with a
boolean success field. Timestamps are ISO‑8601 strings in UTC, and optional values are
always present as null rather than missing.
Free links expire 30 days after creation; their expiresAt tells you when. An expired
link stops redirecting. Links that never expire have "expiresAt": null.
Authentication
There are no accounts or global API keys. When you create a link, the response contains an
apiKey that belongs to that link only. It is returned once, so store it safely: it is the only
way to change the link's destination later.
Send it as a bearer token when updating the link:
Authorization: Bearer YOUR_API_KEY
Creating links, reading a link's status and reporting links need no authentication.
Errors
Every error, whatever the endpoint or status code, has the same shape. The error message is
written for humans and is safe to show to your users.
{
"success": false,
"error": "Short code is already taken, please try another"
}
| Status | Meaning |
|---|---|
400 | The request is invalid: a missing or malformed field, a restricted alias, or an alias that is already taken. |
401 | The API key is missing or does not belong to this link. |
404 | The link does not exist or was deleted. Expired links still answer: check their expiresAt. |
413 | The request body is larger than 32 KB. |
429 | Rate limit reached. Wait for the number of seconds in the Retry-After header. |
500 | Something went wrong on our side. Retry later. |
Rate limits
Limits apply per IP address. Requests over the limit receive a 429 response with a
Retry-After: 60 header.
| Endpoint | Limit |
|---|---|
POST /api/create | 1 new link per minute |
POST /api/report | 3 reports per minute |
POST /api/contact (contact form) | 3 messages per minute |
GET /api/{shortCode}/status | 200 requests per minute |
POST /api/{shortCode}/update | 200 requests per minute |
Create a link
POST/api/create
Creates a short link at https://nalnk.cc/{shortCode} and returns it with its API key.
Body
| Field | Description |
|---|---|
shortCodestring, required |
The alias: 3–50 characters, letters, numbers and hyphens ([A-Za-z0-9-]). |
basePathstring, required |
The destination: an absolute http:// or https:// URL, at most 2048 characters. It cannot be another Nanolink short link. |
Example
curl -X POST https://nanolink.work/api/create \
-H "Content-Type: application/json" \
-d '{"shortCode": "my-blog", "basePath": "https://example.com/blog"}'
{
"success": true,
"result": {
"shortCode": "my-blog",
"shortlink": "https://nalnk.cc/my-blog",
"expiresAt": "2026-11-13T09:30:00.000Z",
"basePath": "https://example.com/blog",
"apiKey": "YOUR_API_KEY"
}
}
Errors: 400 invalid or restricted alias or URL, or alias already taken; 429 rate limit reached.
Get a link's status
GET/api/{shortCode}/status
Returns where a link points and when it expires. No authentication needed.
Example
curl https://nanolink.work/api/my-blog/status
{
"success": true,
"result": {
"shortCode": "my-blog",
"basePath": "https://example.com/blog",
"createdAt": "2026-10-14T09:30:00.000Z",
"expiresAt": "2026-11-13T09:30:00.000Z"
}
}
Errors: 404 the link does not exist or was deleted.
Update the destination
POST/api/{shortCode}/update
Points an existing link somewhere else. Requires the link's API key.
Body
| Field | Description |
|---|---|
basePathstring, required |
The new destination: an absolute http:// or https:// URL. |
Example
curl -X POST https://nanolink.work/api/my-blog/update \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{"basePath": "https://example.com/blog/2026"}'
{
"success": true,
"result": {
"shortCode": "my-blog",
"basePath": "https://example.com/blog/2026",
"expiresAt": "2026-11-13T09:30:00.000Z"
}
}
Errors: 400 invalid URL, 401 wrong or missing API key, 404 unknown link.
Report links
POST/api/report
Reports one or more links that violate our terms of service or are used maliciously. You get a case number back. If you include an email address, we can email you the case number and status updates about the case; every email has an unsubscribe link. You can also use the report form.
Body
| Field | Description |
|---|---|
shortlinksstring[], required |
1–10 links, as aliases (my-blog) or full short links (https://nalnk.cc/my-blog). |
reasonstring, required |
One of spam, phishing, malware, inappropriate, copyright, illegal, other. |
descriptionstring, optional |
Details that help us investigate, 10–1000 characters. |
emailstring, optional |
Where we can send the case number and status updates. |
Example
curl -X POST https://nanolink.work/api/report \
-H "Content-Type: application/json" \
-d '{
"shortlinks": ["https://nalnk.cc/suspicious-link"],
"reason": "phishing",
"description": "Fake bank login page asking for card details.",
"email": "you@example.com"
}'
{
"success": true,
"message": "Thank you for your report. A confirmation email with case number has been sent.",
"reportId": "b1946ac9-2f0c-4b6e-9a51-6f3c7e1d2a40",
"caseNumber": "CR-20261014-AB12CD34"
}
Errors: 400 invalid fields, or links that do not exist ("The following
shortlinks do not exist: …"), 429 rate limit reached.
Path and query passing
Anything after the alias is forwarded to the destination. Extra path segments are appended to the destination's path and query parameters are added to its query string.
# Link "shop" points to https://example.com/store
https://nalnk.cc/shop/shoes?size=42
# redirects to
https://example.com/store/shoes?size=42
Questions or ideas? Send us a message.