API & bookmarklets

Getting started

Every endpoint lives under https://asus.lol/api, takes and returns JSON, and works without a key. Shorten a link:

curl -X POST https://asus.lol/api/shorten \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com/a/very/long/path?utm_source=newsletter"}'

{
  "code": "aB3xYz",
  "short": "https://asus.lol/aB3xYz",
  "url": "https://example.com/a/very/long/path?utm_source=newsletter",
  "token": "q8…",            // owner token: keep it to edit or delete the link
  "expiresAt": null,
  "maxClicks": null,
  "protected": false
}

API keys

Requests from browsers on asus.lol pass an invisible bot check. Scripts can't, so when the check is switched on they need a key. Send it as a header and you also get a separate limit of 60 requests a minute:

X-API-Key: ak_…

Short links

Create one link with url, or up to 10 with urls (the response is then {"links": [...]}, each with its own result or error). Every option is optional:

Public info: destination (hidden for password-protected links), clicks, expiry, the custom preview and whether Google flags the destination as unsafe.

Change the destination and/or the preview. Send the owner token from when the link was made: Authorization: Bearer <token>. Body: {"url": "…"}, {"preview": {…}} or {"preview": null} to remove it.

Delete the link and its stats, with the same Authorization header.

Stats

Total clicks, clicks per day for the last 30 days (UTC), and the top countries, referrers, devices, browsers and operating systems. Crawlers and link-preview bots aren't counted. The same numbers are on asus.lol/:code+.

{
  "clicks": 412,
  "days": [{ "day": "2026-10-19", "n": 37 }, …],
  "countries": [{ "country": "US", "n": 120 }, …],
  "referrers": [{ "referrer": "t.co", "n": 88 }, { "referrer": "", "n": 61 }, …],
  "devices": [{ "device": "mobile", "n": 301 }, …],
  "browsers": [{ "browser": "Safari", "n": 140 }, …],
  "os": [{ "os": "iOS", "n": 150 }, …]
}

Temp mail

Create an inbox. Body: {"ttl": 3600 | 86400 | 604800, "name": "optional"}. Returns address, an access token and expiresAt. Every other call sends Authorization: Bearer <token>.

The inbox, newest first. Each message has from, subject, snippet, and the one-time code and verification link if one was found. Add ?rev=N&wait=1 (with the rev from the last response) to wait up to 20 seconds for new mail instead of polling.

One message with its text and HTML. /raw returns the original .eml, /files/:n an attachment.

Extend the inbox ({"ttl": …} from now) or delete it with all its mail.

# Wait for a sign-up code (bash + jq)
BOX=$(curl -s -X POST https://asus.lol/api/mail -H "Content-Type: application/json" -d '{"ttl":3600}')
ADDR=$(echo "$BOX" | jq -r .address); TOKEN=$(echo "$BOX" | jq -r .token)
echo "Sign up with $ADDR"
curl -s "https://asus.lol/api/mail/$ADDR?rev=0&wait=1" -H "Authorization: Bearer $TOKEN" | jq '.messages[0].code'

Errors & limits

Errors come back as {"error": "name"} with a matching HTTP status: invalid_url, blocked (other shorteners, raw IPs), unsafe (flagged by Google), alias_taken, rate_limited (429), bot_check (403, send an API key), forbidden, not_found.

• Without a key: 10 new links or inboxes per minute per IP.
• With a key: 60 requests per minute per key.
• Reading stats and inboxes isn't rate limited, but please long-poll inboxes rather than polling in a tight loop.
• Abuse (phishing, malware, spam) gets keys and links switched off. Report it to abuse@asus.lol.

Bookmarklets

Drag a button to your bookmarks bar. Click it on any page to shorten that page's address, or turn it into a QR code, in a new tab.

No bookmarks bar? Press Ctrl+Shift+B (⌘⇧B on a Mac) to show it. On a phone, use Share → asus.lol after installing the app.