Authentication

The Link Squeeze API authenticates with a personal access token , an API key you generate from the dashboard, sent as a bearer token on every request.


Authorization: Bearer {your_api_key}


curl https://app.linksqueeze.io/api/v1/links \
  -H "Authorization: Bearer $LINKSQUEEZE_API_KEY" \
  -H "Accept: application/json"

A request with no token, or with a token that has been revoked or has expired, returns 401 unauthenticated.

Generate an API key

Open the API settings

Go to Integrations → API in the dashboard .

Name the key and pick its scopes

Give the key a name you will recognise later (production-worker, zapier, analytics-export) and tick the scopes it needs. At least one scope is required.

Copy the key

The key is shown once, immediately after creation. Store it in your secret manager or environment before leaving the page. It cannot be retrieved again. If you lose it, delete the key and generate a new one.

Treat an API key like a password. It carries the full authority of the scopes it was issued with, and anyone holding it can act on your account. Never commit one to source control or ship it in client-side code.

Scopes

Each API key is issued with one or more scopes (also called abilities). A scope grants a specific class of access, and every endpoint declares the one it requires.

Scope	Grants
`links:read`	List and read links, clicks, and click statistics
`links:write`	Create, update, and delete links
`domains:read`	List and read custom domains
`domains:write`	Add, update, verify, and delete custom domains
`pixels:read`	List and read retargeting pixels
`pixels:write`	Create, update, and delete retargeting pixels
`webhooks:manage`	List, create, and delete webhook subscriptions

Read and write are separate scopes, so a key can be granted links:read alone for an export job without also being able to modify anything.

There is no wildcard scope. A key that needs full access must be issued with each of the seven scopes explicitly.

When a scope is missing

Calling an endpoint your key does not have the scope for returns 403 forbidden. The key is valid and was authenticated successfully; it simply is not permitted to perform that particular action.


{
  "error": {
    "code": "forbidden",
    "message": "Invalid ability provided."
  }
}

The fix is to generate a new key with the scope included. Scopes on an existing key cannot be changed after it is created.

Plan requirement

API access is gated on an active plan. The gate runs after authentication, so an invalid key still returns 401 rather than leaking whether the account is subscribed.

An authenticated key on an account without an active plan returns 402:


{
  "error": {
    "code": "payment_required",
    "message": "An active plan is required to use the API."
  }
}

Access is granted for a lifetime purchase, a running trial, or a live subscription. A subscription that has lapsed into past_due or incomplete ,for example after a card failure, loses API access until it is resolved.

Identify the account a key belongs to

GET /v1/me returns the account the calling key was issued for. It requires no particular scope and can be used for a credential check. Use it to confirm a key still works, and to show a person which account they just connected.


curl https://app.linksqueeze.io/api/v1/me \
  -H "Authorization: Bearer $LINKSQUEEZE_API_KEY" \
  -H "Accept: application/json"


{
  "data": {
    "id": "1d7e0a63-4b28-4f9c-85a1-6e3d2c7b90f4",
    "first_name": "Ada",
    "last_name": "Lovelace",
    "name": "Ada Lovelace",
    "email": "ada@example.com",
    "created_at": "2026-01-14T09:02:55.000000Z"
  }
}

Field	Type	Description
`id`	uuid	The account’s identifier
`first_name`	string \| null	Given name
`last_name`	string \| null	Family name
`name`	string \| null	Both names joined, for display; `null` when neither is set
`email`	string	The account’s email address
`created_at`	timestamp	When the account was created

A 200 here means the key is live and the plan is active. A 401 means the key is invalid or revoked; a 402 means the key is fine but the account has no active plan.

Audit your keys

GET /v1/tokens lists every API key on the account, so you can review what is live without needing the plaintext keys again.

Scope required: none beyond a valid key.


curl https://app.linksqueeze.io/api/v1/tokens \
  -H "Authorization: Bearer $LINKSQUEEZE_API_KEY" \
  -H "Accept: application/json"


{
  "data": [
    {
      "name": "production-worker",
      "abilities": ["links:read", "links:write"],
      "last_used_at": "2026-08-28T09:51:11.000000Z",
      "expires_at": null,
      "created_at": "2026-06-02T14:20:07.000000Z"
    }
  ]
}

Field	Type	Description
`name`	string	The name given at creation
`abilities`	array of strings	Scopes this key holds
`last_used_at`	timestamp \| null	When the key last authenticated a request; `null` if it has never been used
`expires_at`	timestamp \| null	When the key expires; `null` means it does not expire
`created_at`	timestamp	When the key was generated

This response never contains the key itself, and carries no identifier - keys are distinguished by the name you gave them, which is a good reason to name them distinctly. Revoking a key is done from the dashboard, not the API.

Revoke a key by deleting it from Integrations → API in the dashboard. Revocation takes effect immediately.