Business plan

QR Code Desk REST API

List your dynamic QR codes, create link codes, change where a code goes and read daily scan counts from your own software. The API is part of the Business plan.

Keys

Create a key in your account under Account → API keys. It's shown once; we keep only a hash. Send it in the Authorization header. A key works on its account's codes (shared with your team), with the same plan limits and link checks as the app. Revoked keys, keys of people removed from a team and keys of accounts that are no longer on Business stop working. Up to 5 active keys per account.

curl https://qrcodedesk.com/api/v1/codes \
  -H "Authorization: Bearer qcd_YOUR_KEY"

Limits

60 requests a minute and 1,000 a day (UTC) per key, and 2,000 a day for all of an account's keys together. A code's destination can be changed through the API up to 10 times in 24 hours. Over a limit you get 429 with a Retry-After header in seconds. Every response has X-RateLimit-Remaining-Day (for the key). Up to 200 codes per list page.

Endpoints

List codes

GET /api/v1/codes?limit=100&offset=0, newest first. has_more tells you whether to fetch the next page (offset + limit).

{"data":[{"id":"6f1c…","name":"Table tents","short_url":"https://qrcodedesk.com/r/ab3k9xq","type":"link",
  "destination":"https://joescafe.com/menu","status":"active","scans_total":412,"folder":"Downtown",
  "tags":["spring"],"created_at":"2026-10-01T09:12:00Z","updated_at":"2026-10-12T16:40:03Z"}],
 "limit":100,"offset":0,"has_more":false}

type is link, pdf, menu, card, links, app or coupon. status is active, paused or disabled.

Get one code

GET /api/v1/codes/{id}

Create a link code

POST /api/v1/codes with name (up to 80 characters), destination (a web address) and an optional folder name (created if it doesn't exist). The code gets the account's default design. Returns 201 and the code.

curl -X POST https://qrcodedesk.com/api/v1/codes \
  -H "Authorization: Bearer qcd_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name":"Spring flyer","destination":"https://joescafe.com/spring","folder":"Flyers"}'

Change a destination or name

PATCH /api/v1/codes/{id} with destination and/or name. Printed codes follow the new link right away. Codes that open a PDF or a hosted page (menu, business card, link page, app link, coupon) can be renamed but not repointed here (409); use the app.

curl -X PATCH https://qrcodedesk.com/api/v1/codes/6f1c… \
  -H "Authorization: Bearer qcd_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"destination":"https://joescafe.com/summer"}'

Daily scan counts

GET /api/v1/codes/{id}/scans?from=2026-10-01&to=2026-10-13: scans per UTC day (default: the last 30 days, at most 366 days), with zeros for days without scans. Bots and link previews aren't counted.

{"code_id":"6f1c…","from":"2026-10-01","to":"2026-10-13","timezone":"UTC","total":57,
 "days":[{"day":"2026-10-01","scans":4},{"day":"2026-10-02","scans":0}, …]}

Errors

Errors return JSON like {"error":{"code":"destination_refused","message":"…"}}: 401 unauthorized, 403 plan_required or plan_limit, 404 not_found, 409 not_a_link_code or code_disabled, 422 for invalid input (including links our safety checks refuse: raw IP addresses, user:password links, look-alikes of well-known brands, sites on our block list), 429 rate_limited or too_many_changes, 500 server_error.

Acceptable use

The API follows our Terms, including the acceptable use rules for destinations. Don't share keys or use the API to get around plan limits or link checks. We may revoke keys that are abused.