● v1.0 — Documentation

Waitin Zone Developer Docs

Waitin Zone is a privacy-first URL shortener that turns any long link into a crisp 3–6 character w8.nz short link, secured with 2FA and Google Safe Browsing, served from Cloudflare's global edge in under 50ms. This is the complete reference for the site, the API, and the dashboard.

Introduction

Waitin Zone (w8.nz) lets anyone create ultra-short, permanent links. Links are stored in Cloudflare KV and served from the edge closest to your visitor — no database round-trips, no cold starts.

Core guarantees

Edge-fast: redirects resolve at the Cloudflare PoP nearest the visitor (< 50ms typical).
Safe: every destination is checked against Google Safe Browsing on creation.
Secure: optional TOTP 2FA protects your account and your links.
Lightweight: the UI ships zero heavy frameworks — it loads instantly.

Quick Start

You do not need an account to create a basic 6-character link. For 5-character links and analytics, create a free account.

Shorten from the dashboard

Open w8.nz and sign up free.
Pick a link length (5 chars free, 4 chars Plus, 3 chars Pro).
Paste your long URL, solve the human check, and copy your w8.nz/abcde link.

Shorten via API

curl -X POST https://w8.nz/api/shorten \
  -H "Content-Type: application/json" \
  -d '{"targetUrl":"https://example.com/very/long/path","desiredLength":5}' \
  -b "wz_session=YOUR_COOKIE"

Response:

{
  "success": true,
  "shortCode": "abcde",
  "shortUrl": "https://w8.nz/abcde",
  "targetUrl": "https://example.com/very/long/path"
}

Authentication

The API uses a session cookie issued by /api/auth/login. Send it on every request with -b "wz_session=..." (or the Cookie header).

Endpoint	Method	Body
`/api/auth/register`	POST	`username`, `password` (3–20 alphanumeric)
`/api/auth/login`	POST	`username`, `password`
`/api/auth/logout`	POST	— (requires cookie)

Username rules: 3–20 characters, alphanumeric only. Passwords are hashed; we never store them in plaintext.

Shorten URL

POST /api/shorten

Field	Type	Notes
`targetUrl`	string (URL)	Required. Must be a valid http(s) URL.
`desiredLength`	3 \| 4 \| 5 \| 6	6 = guest, 5 = free, 4 = Plus, 3 = Pro.
`customCode`	string	Optional. Pro can claim branded codes.

Length limits by plan

Guest: 6-character only.
Free: 5-character (100 links/day).
Plus: 4-character (100/day) + 5-character (1,000/day).
Pro: 3-character + 4-character (1,000/day) + 5-character (unlimited).

Redirect

GET https://w8.nz/{shortCode}

Visiting a short link returns a 302 redirect to the stored destination and increments the click counter. If the destination is flagged by Safe Browsing, the redirect is blocked with a warning page.

Analytics

GET /api/dashboard (requires login) returns your links, totals, and a 14-day click distribution.

Plan	Analytics depth
Free	Total clicks only.
Plus	+ Referrers & Devices.
Pro	+ Countries & Browsers.

Per-link click events (last 100) are stored as { timestamp, country, device, browser, referrer }.

Manage Links

Endpoint	Method	Purpose
`/api/links/delete`	POST	Delete one of your short codes.
`/api/subscription/update`	POST	Change plan (free / plus / pro).

Plans & Limits

Feature	Free	Plus	Pro
Monthly	$0	$2.99	$9.99
Annual	$0	$19.99	$49.99
Shortest link	5 chars	4 chars	3 chars
Links / day	100	100 (4-char)	1,000 (4-char)
Analytics	Total	+ Devices	+ Countries
Grace period	—	7 days	7 days

Annual saves up to 58%. Switch billing period from the pricing toggle on the main site.

2FA & Security

Waitin Zone supports TOTP two-factor authentication (Google Authenticator, Authy, 1Password).

Endpoint	Method	Purpose
`/api/2fa/setup`	POST	Begin 2FA setup, returns otpauth URI + QR.
`/api/2fa/confirm`	POST	Verify code, enable 2FA, returns backup codes.
`/api/2fa/disable`	POST	Disable 2FA (requires current code).

Backup codes: store them safely. They let you regain access if you lose your authenticator.

Webhooks (planned)

Pro accounts will be able to register a webhook URL that receives a link.clicked event on every redirect. Signature: X-WZ-Signature HMAC-SHA256 of the raw body with your webhook secret. This section documents the planned contract; it is not yet live.

Errors

All errors return JSON: { "success": false, "error": "message" } with an appropriate HTTP status.

Status	Meaning
401	Login required (e.g. 5-char link needs an account).
403	Plan too low for requested link length.
429	Daily creation quota exceeded.
422	Invalid URL or username format.

FAQ

Are links permanent?

Paid plans keep links for 7 days past expiration (grace period). Free links persist while active.

Do you track users?

We store only what analytics needs (country, device, browser, referrer) and never sell data.

Can I use my own domain?

Branded domains are on the roadmap for Pro. Today all links use w8.nz.

Is there an API library?

The API is plain REST/JSON — call it from any language. No SDK required.