anon.legal
Back to links

A small API.

Create a link, keep its key, delete it when you are done. No API subscription or account required.

https://api.anon.legal

POST /v1/links

curl https://api.anon.legal/v1/links \
  -H 'Content-Type: application/json' \
  -d '{"url":"https://example.com","format":"uuid",
       "expires_in":86400,"max_visits":1}'

format: token (default), uuid or words. length: 32, 64 or 128, for tokens only. expires_in: null or 60–315360000 seconds. password: optional, 8–128 characters. max_visits: null or 1–10000. open_mode: direct (default) or page.

{
  "id": "<generated-id>",
  "url": "https://anon.legal/r/<generated-id>",
  "delete_key": "<43-character-secret>",
  "expires_at": "2026-10-22T12:00:00.000Z",
  "format": "uuid",
  "password_protected": false,
  "open_mode": "direct",
  "max_visits": 1,
  "saved": false
}

DELETE /v1/links/:id

curl -X DELETE https://api.anon.legal/v1/links/LINK_ID \
  -H 'Authorization: Bearer YOUR_DELETE_KEY'

Send the deletion key in the Authorization header, never in a URL. Successful deletion returns 204. A wrong key or missing link returns 404.

More options

Links with open_mode=page, a password or an opening limit show an HTML form. GET and HEAD do not consume an open. The form supplies a short-lived token; a successful POST spends one open atomically.

Your links

The website uses /v1/auth/register, /login, /logout and /session, plus GET /v1/me/links and DELETE /v1/me/links/:id. These account routes use a host-only session cookie and same-origin requests. Register with login, password and password_repeat; no email. POST /v1/me/links/:id/claim adds an unowned guest link using its key in Authorization: Bearer. GET /v1/me/links accepts sort=newest|oldest|opens and an opaque cursor, and returns aggregate opens and totals. Open counts are not unique visitors; counts can change while paging by popularity. Public key-based API requests do not use an account session.

Public requests: best-effort 1000/second/IP. Sign-in and password operations have tighter limits. A 429 response includes Retry-After. Inputs over 16 KiB are rejected.