A REST API for links, folders, tags and click analytics
Bearer-token authentication, a per-plan rate limit on each key, and a published list of exactly which endpoints a key can reach. On every plan, including Free — create a key in the dashboard and start calling.
On every plan, including Free · No credit card required
clik_live_4f8Xq2…9dLmQuick answer
What is the ClikSo URL shortener API?
The ClikSo API is a REST interface for creating and managing short links, folders and tags and reading their click analytics, on every plan including Free. Requests authenticate with a Bearer key that begins clik_live_ and is pinned to one workspace, at 30 to 500 requests a minute depending on the plan. Anything outside the published allowlist returns 403.
- Requests per API key per minute, rising with the plan
- 30–500Requests per API key per minute, rising with the plan
- The prefix every live ClikSo API key carries
- clik_live_The prefix every live ClikSo API key carries
- Read, write and admin, chosen when you create a key
- 3 scopesRead, write and admin, chosen when you create a key
- Every key is pinned to a single workspace
- 1 workspaceEvery key is pinned to a single workspace
- Every plan, including Free — 3 keys on Free, 10 on Starter, 20 on Pro, 30 on Business
- Authorization: Bearer clik_live_… — an X-API-Key header is not supported
- 30 requests per minute per key on Free, 100 on Starter, 300 on Pro, 500 on Business; 30 failed authentications per minute per IP
- Click analytics through three POST endpoints, with a daily quota per workspace: 100 on Free up to 20,000 on Business
- Scopes read, write and admin; a key never exceeds the workspace role of whoever created it
How to use the ClikSo API
Four steps from an empty settings page to a link created from code.
Create a key at Settings → API
Workspace admins can generate a key, give it a name of up to 30 characters and choose its scopes: read, write or admin. The scopes stack — write includes read, and admin includes both.
Copy it once
The full secret is shown exactly once, at creation, and cannot be retrieved afterwards. Put it in your secrets manager there and then. A key can later be renamed, revoked so it stops working, or deleted outright.
Send it as a Bearer token
Every request carries Authorization: Bearer clik_live_… — there is no X-API-Key header, and a request without a valid Bearer value is rejected. Each key is pinned to one workspace, so the key decides which workspace you are writing to.
Stay inside the allowlist and the rate limit
Keys reach the link, folder, tag and analytics endpoints listed below; anything else returns 403 before a single database query runs. The rate limit is per key, per minute, and rises with the plan — 30 on Free, 100 on Starter, 300 on Pro, 500 on Business. The analytics endpoints also have their own quota per workspace, and repeated failed authentication is throttled separately, at 30 a minute per IP address.
One request, and what comes back
Create a key at Settings → API and this is the call you make first. Every endpoint, field and error is in the API reference, and the quickstart walks through it step by step.
The same request in JavaScript
const res = await fetch("https://app.clik.so/api/links", {
method: "POST",
headers: {
Authorization: `Bearer ${process.env.CLIKSO_API_KEY}`,
"Content-Type": "application/json",
},
body: JSON.stringify({
destination_url: "https://example.com/spring-sale",
short_code: "spring26",
}),
});
const link = await res.json();The same request in Python
import os
import requests
res = requests.post(
"https://app.clik.so/api/links",
headers={"Authorization": f"Bearer {os.environ['CLIKSO_API_KEY']}"},
json={
"destination_url": "https://example.com/spring-sale",
"short_code": "spring26",
},
)
print(res.json())Exactly what an API key can reach
The allowlist is published rather than discovered. A key that calls anything not on this list gets a 403 before a single database query runs — and so does the route that reveals a link's password, even though it sits under /api/links.
/api/linksAll methods — list, create, read, update, delete/api/links/bulkBulk delete, archive or unarchive, and move to folder — up to 100 links/api/links/slug-checkIs this back-half available?/api/links/ai-slugThree AI-suggested back-halves for a destination/api/links/og-previewFetch the destination’s own preview card/api/foldersAll methods/api/tagsAll methods/api/domainsGET only — list your custom domains/api/workspace/domain-prefsGET only/api/system-domainsThe free branded domains, such as clik.is/api/workspace/bootstrapWorkspace and plan context/api/workspace/usageLinks and clicks used against your plan/api/extensionEndpoints the ClikSo browser extension uses/api/analytics/summaryPOST only — click totals, and breakdowns by country, city, device, browser, OS, referrer and UTM/api/analytics/timeseriesPOST only — clicks over time/api/analytics/filterPOST only — recent raw clicks, up to 1,000 rowsThe analytics quota
The three analytics endpoints share one allowance per workspace, on top of each key's rate limit. They only return clicks inside your plan's data retention window, and the AI analytics chat is not part of the API.
| Plan | Per minute | Per day |
|---|---|---|
| Free | 5 | 100 |
| Starter | 10 | 1,000 |
| Pro | 30 | 5,000 |
| Business | 60 | 20,000 |
Enterprise quotas are set per contract. Every number is also on the limits page of the docs.
What people build with it
Everything below maps to an endpoint on the allowlist above — no roadmap features.
Links created by your own product
Generate a branded short link at the moment a record is created — an order, a ticket, an invoice — instead of making someone paste URLs into a dashboard afterwards.
Checking a slug before you commit to it
The slug-check endpoint answers whether a back-half is free, so your own form can validate it before your user hits save rather than after.
Letting AI name the link
The AI-slug endpoint returns three suggested back-halves for a destination, already availability-checked, so an automated pipeline can pick a readable slug instead of a random one.
Keeping folders and tags in step
Folders and tags are full read-write resources. A client onboarded in your CRM can get its folder in ClikSo in the same script, with the tags your reporting expects.
Housekeeping scripts
The bulk endpoint archives, deletes or moves up to 100 links per call — the practical way to retire a campaign’s links at the end of a quarter without clicking through a list.
Click stats on your own dashboard
The analytics endpoints return click totals, breakdowns by country, device, browser, referrer and UTM, and clicks over time, and the usage endpoint reports where you are against your plan’s allowances — enough for an internal report without copying numbers out of the dashboard.
Link APIs compared
Free API access and a public reference are table stakes, and ClikSo has both. The row we lose is volume: Dub.co and Short.io publish higher ceilings than our per-key limits, and our analytics endpoints carry a daily quota per workspace.
| Capability | ClikSo | Bitly | Dub.co | Short.io | TinyURL |
|---|---|---|---|---|---|
| Published rate limit | 30–500 req/min | 1k–50k req/month | 60–3,000 req/min | ~1,000 links / 5 s | 10k calls/month |
| API access on the free plan | |||||
| Endpoints for click analytics | Every plan | Pro and above | Not documented | ||
| Public API reference published |
Competitor details taken from each provider's own published pricing and documentation, last verified 16 September 2026. Bitly and TinyURL publish monthly API request quotas rather than a per-minute rate; Dub.co and ClikSo publish a per-minute limit.
Good to know
- Analytics has its own quota. On top of the per-key rate limit, the analytics endpoints allow 5 requests a minute and 100 a day per workspace on Free, up to 60 a minute and 20,000 a day on Business, and they only return clicks inside your plan’s retention window. The AI analytics chat is not part of the API.
- Plan-gated features stay plan-gated. A password, tracking pixels or a custom social preview needs Starter, and geo targeting, device targeting or A/B testing needs Pro — through the API as well as the dashboard. A key on a lower plan gets a 402 error that names the plan required.
- Some things stay in the dashboard. Custom domains are read-only to a key, the route that reveals a link’s password is refused, and keys cannot manage members, billing or other keys. There are no webhooks.
- The bulk endpoint is not an importer. It deletes, archives, unarchives and moves up to 100 existing links per call — there is no bulk link creation and no CSV import anywhere in ClikSo.
- Only the Bearer header works, and a key never outranks its creator. Authorization: Bearer clik_live_… is the single supported method; an X-API-Key header is rejected. The effective permission is the lower of the key’s scope and the workspace role of the admin who created it, and the secret is shown once.
API access by plan
The API is on every plan, including Free. What rises with the plan is how many keys the workspace can hold, how fast each key can call, and how many analytics requests the workspace can make in a day — all of it on the limits page of the docs. Keys are created by admins of a shared workspace and can manage custom short links.
Frequently asked questions
Go to Settings → API in the dashboard and generate a key. Only workspace admins can create or manage keys. You give the key a name and choose its scopes — read, write or admin — and the full secret is shown exactly once, at creation.
Send the key as a Bearer token: Authorization: Bearer clik_live_… on every request. An X-API-Key header is not supported. Each key is pinned to a single workspace, and its effective permission is the lower of the key’s scope and the workspace role of the person who created it.
They are per key, per minute, and rise with the plan: 30 requests on Free, 100 on Starter, 300 on Pro and 500 on Business, with Enterprise limits set per contract. The analytics endpoints also share a quota per workspace, from 5 a minute and 100 a day on Free to 60 a minute and 20,000 a day on Business. Failed authentication attempts are separately limited to thirty a minute per IP address.
Links, folders and tags with all methods, including the bulk, slug-check, AI-slug and preview endpoints under links; the summary, timeseries and filter analytics endpoints as POST only; custom domains and workspace domain preferences as GET only; plus the system-domains, workspace bootstrap, workspace usage and extension endpoints. Anything outside that allowlist returns 403 before any database query runs, and so does the route that reveals a link’s password.
Create, edit and delete short links, manage the folders and tags that organise them, and read their click analytics, from your own code. The same key can check whether a slug is free, ask for AI slug suggestions, preview a destination’s social card, and delete, archive, unarchive or move up to 100 links to a folder in one call. It can also read your custom domains and your workspace usage.
Yes, on every plan. Three POST endpoints return click totals and breakdowns by country, city, device, browser, operating system, referrer and UTM, clicks over time, and up to 1,000 recent raw clicks. They share a quota per workspace, from 100 requests a day on Free to 20,000 on Business, and only return clicks inside your plan’s retention window. The AI analytics chat is not part of the API.
Revoke it at Settings → API. A revoked key is refused, and because every key is separate, your other integrations keep running while you create a replacement. Each key also carries its own scope — read, write or admin — so a key handed to a script never needs more access than that script does.
Any plan, including Free. What rises with the plan is the number of keys (3 on Free, 10 on Starter, 20 on Pro, 30 on Business), the per-key rate limit and the daily analytics quota. Link features that need a paid plan need it through the API too: a password, tracking pixels or a custom social preview needs Starter, and geo targeting, device targeting or A/B testing needs Pro.
Yes, through the ClikSo MCP server at https://app.clik.so/mcp rather than an API key. Claude, ChatGPT, Gemini, Cursor, VS Code and other AI apps that support remote MCP servers sign in to ClikSo with OAuth and follow the same plan limits as API keys, on every plan including Free. Changes and deletes wait for your approval by default.
At clik.so/docs. It has a quickstart that takes you from a new key to your first short link, step-by-step guides, and a reference for every endpoint an API key can call.
Related features
Or see everything in the full feature list.
AI apps (MCP)
Create and manage short links from Claude, ChatGPT, Gemini, Cursor and other AI apps. You sign in instead of sharing a key, and changes wait for your approval.
On every plan, including FreeCustom short links
Choose the back-half of every link, group links with / on paid plans, change it later, and let AI suggest one.
On every plan, including FreeTeam workspaces
Shared link libraries with admin, editor and viewer roles — so the intern cannot re-point your campaign.
On every plan, including FreeLast reviewed 16 September 2026 against the live product. Competitor details come from each provider's own published pricing and developer documentation. See the full feature list, the developer docs or ClikSo vs Dub.co.
Ready to get started?
Join the marketers and developers building the future of link sharing.
Free forever plan. No credit card required.