INBIO has two tiers of API access, and the first one needs no credentials at all.
Keyless endpoints — no auth
These work without an account, a key, or a token:
| Endpoint | What it does |
|---|---|
POST /api/shorten |
Shorten a URL |
GET /api/qr |
Generate a styled QR code |
Send nothing but the request. Abuse is controlled with rate limits, not accounts.
API tokens — the full REST API
Everything under https://in.bio/api/v1 uses bearer tokens:
Authorization: Bearer <token>
Accept: application/json- Create an account at in.bio/register. API access is included in the Pro and Business plans.
- Go to Settings → API tokens and create a token, selecting the scopes it should carry.
- Keep it secret — tokens are shown once. Revoke and re-create if leaked.
Scopes
Token abilities act as scopes; a token can only do what was selected at creation:
| Scope | Grants |
|---|---|
links:read |
List/read links, QR codes, folders, tags |
links:write |
Create, update, delete, enable/disable, bulk create |
analytics:read |
Per-link analytics |
Requests missing a scope return 403 with error.type = "scope" and the
required scope named in the response.
Errors you’ll meet
| Status | Meaning |
|---|---|
401 |
Missing or invalid token |
403 error.type=plan |
Your plan doesn’t include API access |
403 error.type=scope |
Token lacks the required scope |
404 |
Resource doesn’t exist — or isn’t yours (never 403) |
For AI agents
Agents authenticate exactly the same way — a human creates the token, the
agent sends the header. The MCP server forwards your
Authorization header to the API, and machine-readable instructions live at
in.bio/auth.md. There is no OAuth flow and no
programmatic registration — that’s deliberate, and documented honestly.