Authentication

The Link Squeeze API authenticates with a personal access token — an API key you generate from the dashboard — sent as a bearer token on every request.


Authorization: Bearer {your_api_key}


curl https://app.linksqueeze.io/api/v1/links \
  -H "Authorization: Bearer $LINKSQUEEZE_API_KEY" \
  -H "Accept: application/json"

A request with no token, or with a token that has been revoked or has expired, returns 401 unauthenticated.

Generate an API key

Open the API settings

Go to Integrations → API in the dashboard .

Name the key and pick its scopes

Give the key a name you will recognise later (production-worker, zapier, analytics-export) and tick the scopes it needs. At least one scope is required.

Copy the key

The key is shown once, immediately after creation. Store it in your secret manager or environment before leaving the page — it cannot be retrieved again. If you lose it, delete the key and generate a new one.

Treat an API key like a password. It carries the full authority of the scopes it was issued with, and anyone holding it can act on your account. Never commit one to source control or ship it in client-side code.

Scopes

Each API key is issued with one or more scopes (also called abilities). A scope grants a specific class of access, and every endpoint declares the one it requires.

Scope	Grants
`links:read`	List and read links, clicks, and click statistics
`links:write`	Create, update, and delete links
`domains:read`	List and read custom domains
`domains:write`	Add, update, verify, and delete custom domains
`pixels:read`	List and read retargeting pixels
`pixels:write`	Create, update, and delete retargeting pixels
`webhooks:manage`	List, create, and delete webhook subscriptions

Read and write are separate scopes, so a key can be granted links:read alone for an export job without also being able to modify anything.

There is no wildcard scope. A key that needs full access must be issued with each of the seven scopes explicitly.

When a scope is missing

Calling an endpoint your key does not have the scope for returns 403 forbidden — not 401. The key is valid and was authenticated successfully; it simply is not permitted to perform that particular action.


{
  "error": {
    "code": "forbidden",
    "message": "Invalid ability provided."
  }
}

The fix is to generate a new key with the scope included. Scopes on an existing key cannot be changed after it is created.

Plan requirement

API access is gated on an active plan. The gate runs after authentication, so an invalid key still returns 401 rather than leaking whether the account is subscribed.

An authenticated key on an account without an active plan returns 402:


{
  "error": {
    "code": "payment_required",
    "message": "An active plan is required to use the API."
  }
}

Access is granted for a lifetime purchase, a running trial, or a live subscription. A subscription that has lapsed into past_due or incomplete — for example after a card failure — loses API access until it is resolved.

Audit your keys

GET /v1/tokens lists every API key on the account, so you can review what is live without needing the plaintext keys again.

Scope required: none beyond a valid key.


curl https://app.linksqueeze.io/api/v1/tokens \
  -H "Authorization: Bearer $LINKSQUEEZE_API_KEY" \
  -H "Accept: application/json"


{
  "data": [
    {
      "id": 42,
      "name": "production-worker",
      "abilities": ["links:read", "links:write"],
      "last_used_at": "2026-08-28T09:51:11.000000Z",
      "expires_at": null,
      "created_at": "2026-06-02T14:20:07.000000Z"
    }
  ]
}

Field	Type	Description
`id`	integer	Key identifier, used to delete the key from the dashboard
`name`	string	The name given at creation
`abilities`	array of strings	Scopes this key holds
`last_used_at`	timestamp \| null	When the key last authenticated a request; `null` if it has never been used
`expires_at`	timestamp \| null	When the key expires; `null` means it does not expire
`created_at`	timestamp	When the key was generated

This response never contains the key itself. id here is the numeric token id, not a UUID — it is the one identifier in the API that is not a UUID, because it refers to a credential rather than a resource.

Revoke a key by deleting it from Integrations → API in the dashboard. Revocation takes effect immediately.