Authentication

API Key Format

API keys use the format u2l_live_ followed by 32 random hexadecimal characters. The u2l_live_ prefix makes keys easy to identify and scan for accidental leaks.

u2l_live_a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6

Getting Your API Key

1. Log in to your U2L Dashboard
2. Navigate to Settings → API
3. Click Create API Key and optionally add a label (e.g., “Production”, “CI/CD”)
4. Copy the key immediately - it will only be shown once

Making Authenticated Requests

Include your API key in the Authorization header of every request using the Bearer scheme:

curl https://u2l.ai/api/v1/links \
  -H "Authorization: Bearer u2l_live_your_api_key"

const response = await fetch("https://u2l.ai/api/v1/links", {
  headers: {
    "Authorization": "Bearer u2l_live_your_api_key",
  },
});

const data = await response.json();

import requests

response = requests.get(
    "https://u2l.ai/api/v1/links",
    headers={
        "Authorization": "Bearer u2l_live_your_api_key"
    }
)

data = response.json()

Error Responses

If authentication fails, the API returns a 401 or 403 status code:

Missing or invalid key

{
  "error": {
    "code": "unauthorized",
    "message": "Missing API key. Include it as: Authorization: Bearer u2l_live_..."
  }
}

Invalid format

{
  "error": {
    "code": "unauthorized",
    "message": "Invalid API key format. Keys start with u2l_live_ followed by 32 characters."
  }
}

Revoked or expired key

{
  "error": {
    "code": "unauthorized",
    "message": "This API key has been revoked."
  }
}

API Key Limits by Plan

Every plan includes API access. Use a separate labeled key per integration so each can be revoked independently:

Security Best Practices

• Never commit API keys to source control. Use environment variables instead.
• Rotate keys regularly by revoking old keys and creating new ones from your dashboard.
• Use labels to identify where each key is used (e.g., “Production”, “Staging”).
• Revoke compromised keys immediately from Settings → API in your dashboard.