The koza API.
Everything the sites do, over plain HTTP — mint links, count clicks, open direct lines. No keys, no tokens.
the index at /api/v1 answers json too — point curl anywhere below
01 · Shortener
Mint a short link. Slug is auto-picked unless you claim one.
curl -X POST https://koza.click/api/v1/shorten \ -H 'content-type: application/json' \ -d '{"url": "https://github.com/dimskoff/koza", "slug": "gh", "password": "open-sesame"}'
{ "link": { "slug": "gh", "url": "https://github.com/dimskoff/koza", "short_url": "https://koza.click/gh", "password": true, "clicks": 0, "created_at": "2026-11-05T09:00:00.000Z" }}
400 · bad url or slug 409 · taken or reserved
Every link on this server, newest first.
Look up one link — destination, lock state, clicks.
Count a click. The redirect page calls this for you.
Trade the password for the destination url.
Burn a link. The short url stops resolving immediately.
02 · Box
Open a direct line. Returns the code a receiver needs.
Every live line on this server.
Inspect one line — staged files, lock state, expiry.
Close the line early. Works with x-koza-key — or with the x-koza-token the creator got.
Short-lived TURN credentials for the webrtc handshake (coturn use-auth-secret). Null when the server runs stun-only.
ground rules
- · in-memory demo store — resets when the server process does
- · passwords live as a tiny digest, never in plain text
- · no auth, no rate limits — be nice, it's a zoo animal