Turn a long URL into three characters, from your own code.

01 Introduction

Waitin Zone shortens a URL to a three-to-six character code served from Cloudflare's edge. The same HTTP API the site's own pages use is the one documented here — there is no second, private interface, so anything the dashboard can do you can do.

Base URL

https://w8.nzCopy

Conventions

• Request bodies are JSON. Send Content-Type: application/json.
• Every response is JSON with a boolean success field.
• A failure carries a human-readable error string. It is written to be shown to a person as-is.
• Times are UTC. Durations are seconds unless the field name says otherwise.
• Short codes are case sensitive: a4f and A4F are different links.

02 Quickstart

The shortest useful request. No account, no headers beyond the content type, six-character code back.

# Create a link
curl -X POST https://w8.nz/api/shorten \
  -H 'Authorization: Bearer w8_…' \
  -H 'Content-Type: application/json' \
  -d '{"targetUrl":"https://example.com/a/very/long/path"}'Copy

{
  "success": true,
  "code": "q7Bxa2",
  "shortUrl": "https://w8.nz/q7Bxa2",
  "targetUrl": "https://example.com/a/very/long/path",
  "length": 6,
  "remaining": 24,
  "limit": 25
}Copy

From JavaScript

const res = await fetch('https://w8.nz/api/shorten', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer ' + process.env.W8_TOKEN,
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({ targetUrl: 'https://example.com/' })
});
const data = await res.json();
if (!data.success) throw new Error(data.error);
console.log(data.shortUrl);Copy

03 Authentication

Two credentials, for two callers. A token is how a program authenticates; a session cookie is how a browser does. Anything not listed as requiring one works without either.

API tokens

A token is w8_ followed by 64 hex characters, sent in an Authorization: Bearer header. It is created in the dashboard, shown once, and stored here only as a hash — there is no endpoint that returns it again, because one that could would let a stolen session cookie harvest every token on the account.

A token also stands in for the human check on /api/shorten, which is its main purpose. Turnstile proves a person is present; a token proves a paid account is. Either is enough to be worth screening a URL for.

{ "success": true, "token": "w8_9f3c…", "hint": "a41b", "shownOnce": true }Copy

A token cannot mint another token, list the account's tokens, or revoke one — all three need the cookie. So a leaked token spends quota and nothing else: it cannot extend its own reach, and it cannot lock you out of revoking it.

Session cookies

Signing in returns a w8_session cookie: HttpOnly, SameSite=Lax, Secure over HTTPS. Send it back on any request that needs an account. When both a cookie and a token arrive, the cookie wins: it proves strictly more, and letting a header override it would let a stolen token act inside somebody's signed-in browser.

{ "success": false, "requires2FA": true }   // send the code and repeatCopy

{
  "success": true,
  "user": {
    "username": "sami",
    "email": "[email protected]",
    "plan": "pro",
    "effectivePlan": "pro",
    "subscriptionStatus": "ACTIVE",
    "subscriptionEndsAt": 1818764275027,
    "cancelAtPeriodEnd": false,
    "twoFactorEnabled": true,
    "backupCodesRemaining": 10,
    "emailVerified": true,
    "createdAt": 1785312000000
  }
}Copy

The rest of the account surface

04 Create a link

{
  "success": true,
  "code": "a4f",
  "shortUrl": "https://w8.nz/a4f",
  "targetUrl": "https://example.com/...",
  "length": 3,
  "remaining": 99,
  "limit": 100
}Copy

05 Following a link

$ curl -sI https://w8.nz/a4f | head -3
HTTP/2 302
location: https://example.com/...
cache-control: no-storeCopy

06 Analytics

{
  "success": true,
  "code": "a4f",
  "plan": "pro",           // which tier the fields below reflect
  "targetUrl": "https://example.com/...",
  "totalHits": 1284,
  "createdAt": 1787228279291, // epoch ms, not a date string
  "devices": { ... },        // null on free
  "referrers": { ... },      // null on free
  "countries": { ... },      // pro only
  "browsers": { ... },       // pro only
  "recentClicks": [ ... ]    // pro only, last 20
}Copy

07 List and delete

curl -X PATCH https://w8.nz/api/link/spring-sale   -H 'Authorization: Bearer w8_…'   -d '{"targetUrl":"https://example.com/spring-v2"}'

{ "success": true, "code": "spring-sale",
  "targetUrl": "https://example.com/spring-v2",
  "previousUrl": "https://example.com/spring" }Copy

{ "success": true, "created": 2, "failed": 1,
  "results": [
    { "index": 0, "status": 200, "code": "yxIjm" },
    { "index": 1, "status": 400, "error": "That doesn't look like a URL…" },
    { "index": 2, "status": 200, "code": "launch-2027" }
  ] }Copy

curl -X DELETE https://w8.nz/api/link/delete/a4f \
  -H 'Cookie: w8_session=…'Copy

08 Errors

Every failure has the same shape. There are no numeric error codes to look up — the string is the contract, and it is written to be displayed.

{ "success": false, "error": "That URL is longer than 2048 characters." }Copy

09 Limits & plans

Quotas are per calendar month and per length, counted in UTC, so every counter turns over together at 00:00 UTC on the first day of the month. A dash means that length is not available on the plan at all.

A customCode spends the custom row, never a length row. A chosen code is not a length: spring-sale is not a six-character link, and charging it to that counter would let an account drain a bucket it never uses.

What a token may do per minute

Guest quota is counted per network address; account quota is counted per account. Sign-in attempts are limited separately, per account and per network. The per-minute rate limit is per account, not per token, so ten tokens share one budget rather than multiplying it.

Analytics depth follows the plan too: Free sees totals, Plus adds devices and referrers, and Pro — along with every Scale step — adds countries, browsers and the last twenty individual clicks.

Limits move with the plan in force right now, not the plan at the time a token was created. A lapsed subscription takes Scale features away from an existing token the moment the provider says it ended; renewing gives them back with no need to re-issue anything.

10 Security

Destinations

Every URL is checked against Google Safe Browsing — malware, social engineering, unwanted software, harmful applications — before a code is generated. A link that fails never exists, so there is nothing to disable later.

Accounts

• Passwords: PBKDF2-SHA256 with a per-account salt, three chained rounds of 100,000 iterations — 300,000 iterations of work in total. It is chained because Workers refuses more than 100,000 iterations in a single call, and one round at the cap is well under what is recommended. Both the iteration count and the round count are stored on each record, so either can be raised later without locking anyone out.
• Two-factor: RFC 6238 TOTP over a 30-second period, accepting one step of drift either side.
• Backup codes: ten, single use, stored only as hashes.
• Changing a password invalidates every existing session.

11 Questions

Can I choose my own code?

Yes, on Scale. Send customCode and you get exactly that code: 3–32 characters of letters, numbers, hyphens and underscores. Names that would shadow a real page on this site — docs, dashboard, privacy and the rest — are refused with a reason rather than quietly swapped for a generated one.

It is a paid feature because that is the reservation model. Free vanity codes on a shortener are a land-grab: the good words go in an afternoon, to whoever scripts it first, and none of them go to the people who would have used them.

Do links expire?

No. A link lives until you delete it, it is reported and retired, or the owning subscription lapses for more than fourteen days — seven days working, seven days paused, then removed.

Is there a bulk endpoint?

Yes, on Scale: POST /api/shorten/bulk, 100 to 1,000 links per call depending on the step. The screening runs concurrently, so a batch costs about one round trip rather than one per link.

Below Scale, call /api/shorten in a loop and respect the quota. Each call is one Safe Browsing round trip and roughly 300 ms.

Are codes case sensitive?

Yes. The alphabet is base62, so a4f and A4F are two different links. Do not lowercase a code before looking it up.

Can I see who clicked?

No, and neither can we. Country, device class, browser and referring host are all that is recorded, none of it joined to a person.