Turn a long URL into three characters, from your own code.

01 Introduction

Waitin Zone shortens a URL to a three-to-six character code served from Cloudflare's edge. The same HTTP API the site's own pages use is the one documented here — there is no second, private interface, so anything the dashboard can do you can do.

Base URL

https://w8.nzCopy

Conventions

• Request bodies are JSON. Send Content-Type: application/json.
• Every response is JSON with a boolean success field.
• A failure carries a human-readable error string. It is written to be shown to a person as-is.
• Times are UTC. Durations are seconds unless the field name says otherwise.
• Short codes are case sensitive: a4f and A4F are different links.

02 Quickstart

The shortest useful request. No account, no headers beyond the content type, six-character code back.

# Create a link
curl -X POST https://w8.nz/api/shorten \
  -H 'Content-Type: application/json' \
  -d '{"targetUrl":"https://example.com/a/very/long/path"}'Copy

{
  "success": true,
  "code": "q7Bxa2",
  "shortUrl": "https://w8.nz/q7Bxa2",
  "targetUrl": "https://example.com/a/very/long/path",
  "length": 6,
  "remaining": 49,
  "limit": 50
}Copy

From JavaScript

const res = await fetch('https://w8.nz/api/shorten', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ targetUrl: 'https://example.com/' })
});
const data = await res.json();
if (!data.success) throw new Error(data.error);
console.log(data.shortUrl);Copy

03 Authentication

Signing in returns a w8_session cookie: HttpOnly, SameSite=Lax, Secure over HTTPS. Send it back on any request that needs an account. Anything not listed as requiring a session works without one.

{ "success": false, "requires2FA": true }   // send the code and repeatCopy

{
  "success": true,
  "user": {
    "username": "sami",
    "email": "s***@example.com",
    "plan": "pro",
    "effectivePlan": "pro",
    "twoFactorEnabled": true
  }
}Copy

The rest of the account surface

04 Create a link

{
  "success": true,
  "code": "a4f",
  "shortUrl": "https://w8.nz/a4f",
  "targetUrl": "https://example.com/...",
  "length": 3,
  "remaining": 99,   // null when the plan is unlimited
  "limit": 100       // null when the plan is unlimited
}Copy

05 Following a link

$ curl -sI https://w8.nz/a4f | head -3
HTTP/2 302
location: https://example.com/...
cache-control: no-storeCopy

06 Analytics

{
  "success": true,
  "code": "a4f",
  "targetUrl": "https://example.com/...",
  "clicks": 1284,
  "createdAt": "2026-08-01T09:12:44.000Z",
  "daily": [ ... ],          // 14 days of totals
  "devices": { ... },        // null on free
  "referrers": { ... },      // null on free
  "countries": { ... },      // pro only
  "browsers": { ... },       // pro only
  "recentClicks": [ ... ]    // pro only, last 20
}Copy

07 List and delete

curl -X DELETE https://w8.nz/api/link/delete/a4f \
  -H 'Cookie: w8_session=…'Copy

08 Errors

Every failure has the same shape. There are no numeric error codes to look up — the string is the contract, and it is written to be displayed.

{ "success": false, "error": "That URL is longer than 2048 characters." }Copy

09 Limits & plans

Quotas are per day and per length, and they reset on a rolling 24-hour window rather than at midnight. A dash means that length is not available on the plan at all.

Guest quota is counted per network address; account quota is counted per account. Sign-in attempts are limited separately, per account and per network.

Analytics depth follows the plan too: free sees totals, Plus adds devices and referrers, Pro adds countries, browsers and the last twenty individual clicks.

10 Security

Destinations

Every URL is checked against Google Safe Browsing — malware, social engineering, unwanted software, harmful applications — before a code is generated. A link that fails never exists, so there is nothing to disable later.

Accounts

• Passwords: PBKDF2-SHA256 at 300,000 iterations with a per-account salt. The cost is stored on the record so it can be raised later without locking anyone out.
• Two-factor: RFC 6238 TOTP over a 30-second period, accepting one step of drift either side.
• Backup codes: ten, single use, stored only as hashes.
• Changing a password invalidates every existing session.

11 Questions

Can I choose my own code?

Not yet. You choose the length; the code itself is generated and checked for collisions. Vanity codes would need a reservation and moderation model, and shipping them without one is how a shortener ends up hosting somebody else's brand name.

Do links expire?

No. A link lives until you delete it, it is reported and retired, or the owning subscription lapses for more than fourteen days — seven days working, seven days paused, then removed.

Is there a bulk endpoint?

No. Call /api/shorten in a loop and respect the quota; each call is one Safe Browsing round trip and roughly 300 ms.

Are codes case sensitive?

Yes. The alphabet is base62, so a4f and A4F are two different links. Do not lowercase a code before looking it up.

Can I see who clicked?

No, and neither can we. Country, device class, browser and referring host are all that is recorded, none of it joined to a person.