API & developers
Get an API key
API access runs on the same engine that serves the site (REST API v3) and keys are provisioned per account. That means everything you automate shows up alongside your manually created links - Same dashboard, same private stats.
Requesting a key
Contact us with a couple of sentences about your use case and expected monthly volume, and we'll set you up. A useful request covers:
- What you're building (a CMS plugin, an e-commerce backend, a marketing tool).
- Roughly how many links you'll create per month.
- Whether you'll also pull visit data for reporting.
Keys arrive with rate limits sized to the use case; high-volume needs are covered under enterprise plans. There's no self-serve key page yet, so the short email is the whole process - Most requests are answered fast.
Why keys are provisioned, not self-serve
A shortener's API is a magnet for spammers, and one abusive key can hurt the platform's reputation with browsers and security vendors. A human glance at each use case keeps goto.now links trusted - Which directly protects your links' deliverability.
Authenticating your calls
Authentication is a single header: X-Api-Key: YOUR_KEY on every request. No OAuth dance, no token refresh, no signing - One static header and you're in. Treat the key like a password: keep it in an environment variable or secrets manager, never in client-side code or a public repo, and ask for a replacement if it ever leaks. If a request comes back 401, the header is missing or mistyped - That's the first thing to check before anything else.