Create a link
Creates a short link or QR code. By default the domain is chosen automatically: destinations recognized as trusted land on u2l.ai, everything else on u.gy - this never errors. Pass a specific domain to use one of your subdomains or verified custom domains instead.
Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your U2L API key (u2l_live_...). Create one in the dashboard under Settings > API.
Body
Destination URL. https:// is assumed if no scheme is given.
auto (default) picks the best domain for the destination. Or pass one of your domains from List domains. Defaults to "auto".
Custom slug (5-50 chars, letters/numbers/hyphens/underscores). Random when omitted.
Password-protect the link (Advanced plan or above).
Expiration time (Advanced plan or above).
true = 301 redirect, false = 302. Defaults to true.
One of: SL, QR. Defaults to "SL".
Custom social preview (Advanced plan or above).
Image URL.
A/B testing config (Advanced plan or above).
Variant B destination URL.
Traffic percentage to destination A. Defaults to 50.
QR styling (QR links only; pattern/logo customization requires Pro plan or above).
Defaults to "rounded".
Defaults to "extra-rounded".
Defaults to "dot".
Logo image URL.
URL cloaking (Advanced+): serve the destination inside a frame so visitors keep seeing the short URL.
Open the destination in its native mobile app (YouTube, Instagram, etc.) when the visitor has it installed.
Traffic routing rules (Advanced+). Matched visitors are redirected to the rule URL instead of the base destination; rules override the A/B pick.
Uppercase ISO 3166-1 alpha-2 country code (or default) mapped to a destination URL. Max 20 rules.
Continent code (AF, AN, AS, EU, NA, OC, SA) mapped to a URL. A country rule beats a continent rule.
Device type mapped to a destination URL. Keys: ios, android, mobile, desktop. Specific OS beats the generic mobile bucket.
Lowercase "region|cc" key using the region name (e.g. "karnataka|in") or the ISO 3166-2 code (e.g. "ka|in") mapped to a URL. Beats country rules. Max 20 rules.
Lowercase "city|cc" key (e.g. "bengaluru|in") mapped to a URL. Most specific; IP city detection is best-effort. Max 20 rules.
Expire the link after this many human clicks (Growth+). Enforcement is eventual: the link stops within a few minutes of the limit; bot traffic never counts.
Where visitors are redirected (302) once the link has expired by date or click limit. Unset shows the standard expired page.
Before this time the link serves a not-active-yet page. Must be before expiresAt when both are set.
N-way weighted rotation (Advanced+). Visitors are split randomly across 2-10 target URLs by integer weights summing to 100. Supersedes the legacy abTest fields when set; analytics reports variants as A, B, C... by target order.
Retargeting pixels (Advanced+). Fired from a brief redirect page for human visitors only.
One of: meta, tiktok, gtm, google_ads, linkedin.
Vendor pixel/container/tag ID, e.g. a Meta Pixel ID or GTM-XXXX.
App deep links (Advanced+): 'store' sends mobile visitors without the domain's app installed to the App Store / Play Store (with the link carried in the Play install referrer). Requires a mobile app configured on the link's domain in the dashboard; visitors with the app installed open it directly via the domain's universal/app links. One of: store.
Response 201
The full short URL.
One of: SL, QR.
Present when the domain differs from the one requested (trust-based placement).
Human-readable explanation of the domain choice.
Errors
See Rate Limits & Errors for the error envelope and per-plan limits.