SealedQR API

REST API for embedding QR codes in your application and managing them programmatically.

Authentication

The embed endpoints are public — the 32-character share_token in the URL is the security boundary. Anyone with the token can fetch the PNG, SVG, or JSON; rotate the token from the QR's preview page to invalidate it.

The management endpoints require a personal access token. Create one from your API keys page. Pass it in the Authorization header on every request:

Authorization: Bearer YOUR_API_KEY

Lost a key? Revoke it from the same page and create a new one. The token string is shown only once at creation.

Embed endpoints

These are what you put in your HTML / Figma / slide deck / product UI. Drop-in.

Returns a 300x300 PNG QR with the customisation set on the underlying record (color, logo, error-correction). Cached for 24 hours via Cache-Control: public, max-age=86400. CORS-open.

<img src="https://qrgenerator.macinternetservices.com/api/qr/yGq7YO2mWqZHjqCIUyAYOlNJWwSxmBjY.png" alt="My QR">

Vector version. Same color customisation; logo merge is PNG-only.

JSON metadata about the QR including the PNG/SVG/info/redirect URLs. Pass ?stats=1 for a 30-day daily-scans series.

curl https://qrgenerator.macinternetservices.com/api/qr/yGq7YO2mWqZHjqCIUyAYOlNJWwSxmBjY?stats=1

{
  "type": "url",
  "title": "Spring promo",
  "token": "yGq7YO2mWqZ...",
  "scan_count": 47,
  "urls": {
    "png":      "https://qrgenerator.macinternetservices.com/api/qr/yGq7YO2mWqZHjqCIUyAYOlNJWwSxmBjY.png",
    "svg":      "https://qrgenerator.macinternetservices.com/api/qr/yGq7YO2mWqZHjqCIUyAYOlNJWwSxmBjY.svg",
    "info":     "https://qrgenerator.macinternetservices.com/api/qr/yGq7YO2mWqZHjqCIUyAYOlNJWwSxmBjY",
    "redirect": "https://qrgenerator.macinternetservices.com/r/yGq7YO2mWqZHjqCIUyAYOlNJWwSxmBjY"
  },
  "url": "https://example.com/promo",
  "stats": {
    "total": 47,
    "last_7d": 12,
    "last_30d": 47,
    "daily_labels": ["2026-05-08", "2026-05-09", ...],
    "daily":        [0, 2, 1, 0, ...]
  }
}

Management endpoints

Authenticated. Create QRs programmatically and list the ones you own.

List your URL QRs (newest first, up to 200 per page).

curl -H "Authorization: Bearer $KEY" https://qrgenerator.macinternetservices.com/api/qrs

{
  "data": [
    {
      "id": 42,
      "type": "url",
      "title": "Spring promo",
      "url": "https://example.com/promo",
      "share_token": "yGq7YO2mWqZ...",
      "scan_count": 47,
      "urls": { "png": "...", "svg": "...", "info": "...", "redirect": "..." },
      "created_at": "2026-06-01T12:00:00+00:00",
      "updated_at": "2026-06-06T18:30:00+00:00"
    }
  ],
  "count": 1
}

Create a URL QR. Returns 201 with the new record; 402 if you have hit your plan's QR limit.

curl -X POST https://qrgenerator.macinternetservices.com/api/qrs \
  -H "Authorization: Bearer $KEY" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://example.com/promo","title":"Spring promo"}'

# → 201 Created
{
  "id": 42,
  "type": "url",
  "title": "Spring promo",
  "url": "https://example.com/promo",
  "share_token": "yGq7YO2mWqZ...",
  "urls": { "png": "...", "svg": "...", "info": "...", "redirect": "..." },
  ...
}

Coming soon: bulk CSV upload, PDF and vCard creation via API, webhook events on scans + token rotation, branded redirect domains.

Workspaces

Every QR belongs to a workspace. Free and Pro Identity accounts have one (Personal); Agency accounts can have many — one per client, project, or team.

By default, list and create endpoints operate on your current workspace — the one you last selected in the dashboard. Override with the workspace_id field on writes, or the ?workspace= query on reads. You must be a member of any workspace you target, or the request 403s.

GET  /api/qrs?workspace=42        // list QRs in workspace 42
POST /api/qrs                     // create in current workspace
POST /api/qrs                     // create in explicit workspace
     -d '{"url":"...", "title":"...", "workspace_id": 42}'

POST /api/qrs/bulk                // bulk into current workspace
     -F csv=@file.csv

POST /api/qrs/bulk                // bulk into explicit workspace
     -F csv=@file.csv -F workspace_id=42

Your personal access token belongs to your user, not a workspace — the same token works across every workspace you are a member of.

Rate limits

Each API token is limited to 60 requests per minute at launch. When you exceed it, the server responds 429 Too Many Requests with these headers:

X-RateLimit-Limit:     60
X-RateLimit-Remaining: 0
Retry-After:           42

Wait the number of seconds in Retry-After before issuing the next request. Embed endpoints share the same limit per IP.

Agency-tier customers get elevated limits — email us with your token name and we will raise yours.

Errors

All errors are JSON. Standard shape:

{
  "error": "quota_exceeded",
  "message": "QR limit for your plan reached. Upgrade or delete existing QRs.",
  "limit": 5
}

Common status codes:

• 200 — OK
• 201 — Created (after POST /api/qrs)
• 401 — Missing or invalid Authorization header
• 402 — Quota exceeded for your plan
• 404 — Token not found
• 422 — Validation failed (Laravel format with errors map)
• 429 — Rate limit; see Retry-After

Plan tiers and the API

• Free — embed endpoints work for any QR you create through the web UI. Management endpoints disabled (you can still hit them, but plan limits apply).
• Pro Identity ($9/mo) — same as Free; you get private vCards + analytics in the web UI.
• Agency ($99/mo) — full management endpoints, 25 client sub-accounts, elevated rate limit. Email-based onboarding for now.
• Agency+ ($299/mo) — unlimited sub-accounts, white-label, custom rate limits.

Get a key

Manage API keys Talk to us about Agency tier

Found a bug or want a feature? Email rchatman@macinternetservices.com.