API docs
Authentication
All API requests are authenticated with a single header — no OAuth flow, no session cookies, nothing to expire mid-request.
API key header
Include your key on every request as X-QRGenie-Api-Key. Generate or rotate a key from your dashboard. Keys are shown once at creation — we never store or display the plaintext value again.
curl https://api.qrcode-genie.com/v1/user/data \
-H "X-QRGenie-Api-Key: qrgenie_live_..."Using the API via RapidAPI
If you're calling through the RapidAPI marketplace, authentication and rate limits are handled entirely by RapidAPI's gateway — you won't set an X-QRGenie-Api-Key header yourself.
A note on Authorization: Bearer tokens
If you've inspected requests from the dashboard itself, you may notice it uses a session-based bearer token. That token is short-lived and tied to a logged-in browser session — it isn't a credential meant for external integrations. Always use X-QRGenie-Api-Key for programmatic access.
Check your account status
Useful for confirming a key works and inspecting current plan/usage before you build against limits.
GET
/v1/user/dataFetch account usage
Returns your current plan and billing-cycle usage across requests, bulk jobs, and link edits.
requests counts general API usage; bulk_requests counts bulk generation jobs specifically (separate from the per-request item limit on /qr/bulk); link_edits counts core updates and deletions on existing dynamic links — not initial creation.
All three reset at the start of each billing cycle, alongside subscription_period_end.
Example response · 200
{
"user_id": "[email protected]",
"subscription_plan": "pro",
"requests": 1284,
"bulk_requests": 12,
"link_edits": 47,
"subscription_period_end": "2026-08-01T00:00:00Z",
"dynamic_links_count": 12,
"custom_domains": [
"links.yourbrand.com"
],
"webhooks_count": 2
}Try it
Stored only in this browser's local storage — never sent anywhere but the API itself.
curl -X GET "https://api.qrcode-genie.com/v1/user/data" \
-H "X-QRGenie-Api-Key: <your_api_key>"GET
/v1/user/linksList and filter dynamic links
Paginated, filterable, sortable listing of your dynamic links. Filtering and sorting happen server-side — this endpoint only returns the page you ask for, not your full link set.
Parameters
pageintegeroptionalPage number, 1-indexed.
limitintegeroptionalResults per page (1–100).
sortstring enumoptionalnewest | oldest | most_scans | least_scans | alpha
statusstring enumoptionalall | active | paused | expired
searchstringoptionalMatches against title, short_key, and destination_url.
tagsstring (repeatable)optionalRepeat for multiple — ?tags=a&tags=b. A link must have ALL given tags to match.
total is the count matching your current filters; total_owned is your full link count regardless of filters — use total_owned against your plan limit, and total for pagination math.
Example response · 200
{
"links": [
{
"short_key": "bX9a2",
"short_url": "https://qrcode-genie.com/bX9a2",
"destination_url": "https://destinationsite.com",
"title": "Q3 Marketing Campaign Poster QR",
"tags": [
"marketing",
"q3-campaign"
],
"is_active": true,
"total_hits": 1420,
"created_at": "2026-06-26T03:00:00Z",
"updated_at": "2026-06-26T03:00:00Z",
"qr_config": null
}
],
"total": 12,
"page": 1,
"limit": 15,
"total_pages": 1,
"total_owned": 12
}Try it
Stored only in this browser's local storage — never sent anywhere but the API itself.
curl -X GET "https://api.qrcode-genie.com/v1/user/links?page=1&limit=15&sort=newest&status=all&search=campaign&tags=marketing" \
-H "X-QRGenie-Api-Key: <your_api_key>"Manage custom domains
POST
/v1/user/settings/custom-domainsRegister a custom domain
Verifies your domain's DNS is pointed at our infrastructure, then registers it for use with dynamic links and provisions SSL. Point a CNAME at r.qrcode-genie.com before calling this — see Custom domains under Dynamic Links.
Returns 422 if DNS isn't correctly pointed yet — this is the expected response while propagation is still in progress.
Returns 403 if you've reached your plan's custom domain limit.
Calling this again with an already-registered domain is idempotent and returns success without re-provisioning.
Example response · 200
{
"status": "success",
"verified": true,
"domain": "links.yourbrand.com",
"message": "Domain registered and SSL provisioning initialized successfully."
}Try it
Stored only in this browser's local storage — never sent anywhere but the API itself.
curl -X POST "https://api.qrcode-genie.com/v1/user/settings/custom-domains" \
-H "X-QRGenie-Api-Key: <your_api_key>" \
-H "Content-Type: application/json" \
-d '{"custom_domain":"links.yourbrand.com"}'DELETE
/v1/user/settings/custom-domains/{domain}Remove a custom domain
Deregisters a custom domain from your account. Fails if any dynamic links still reference it.
Parameters
domainstringrequiredThe registered domain to remove.
Returns 409 if any dynamic links still use this domain — reassign or remove them first.
Example response · 200
{
"status": "success",
"verified": false,
"domain": "links.yourbrand.com",
"message": "Domain removed from your account."
}Try it
Stored only in this browser's local storage — never sent anywhere but the API itself.
curl -X DELETE "https://api.qrcode-genie.com/v1/user/settings/custom-domains/links.yourbrand.com" \
-H "X-QRGenie-Api-Key: <your_api_key>"