The tlnk.kr API lets email-verified members call POST /api/v1/shorten with X-API-Key and X-API-Secret headers and get an auto-code short URL back as JSON, so publishing, newsletter and automation workflows can create per-channel campaign links hands-free.
Sign up for free, verify your email, then create a key under My page › API.
https://tlnk.kr/api/v1/shortenSend your values in the X-API-Key and X-API-Secret headers. Never put the secret in the URL (query string).
Send the body as JSON {"url": "…"} or as a form (url=…). Choosing a subdomain name or code is not supported via the API.
curl -X POST https://tlnk.kr/api/v1/shorten \
-H "X-API-Key: ak_…" \
-H "X-API-Secret: sk_…" \
-H "Content-Type: application/json" \
-d '{"url":"https://example.com/very/long/path?utm_source=newsletter"}'
import requests
r = requests.post("https://tlnk.kr/api/v1/shorten",
headers={"X-API-Key": "ak_…", "X-API-Secret": "sk_…"},
json={"url": "https://example.com/very/long/path"}, timeout=30)
print(r.status_code, r.json()["short_url"] if r.ok else r.json())
{
"ok": true,
"code": "Ab3d",
"short_url": "https://tlnk.kr/Ab3d",
"target_url": "https://example.com/very/long/path?utm_source=newsletter",
"created_at": "2026-09-25T09:00:00+09:00",
"daily_remaining": 999
}
{
"ok": false,
"error": "check_failed",
"check": "age",
"message": "…"
}
| Status | error value | Meaning |
|---|---|---|
400 | url_required | The url field is required. |
400 | bad_json | The JSON body is malformed. |
401 | auth | The API key or secret is invalid. |
403 | key_blocked | This API key has been blocked. |
403 | member_blocked | API access for this account has been blocked. |
405 | method | Only POST requests are accepted. |
422 | check_failed | The URL failed the safety check (reason code in check). |
429 | rate_limited | Too many requests. Please try again shortly. |
429 | daily_limit | The 24-hour creation limit has been reached. |
429 | too_many_failures | Too many URLs failed the safety check. Please try again later. |
500 | error | Temporary error. Please try again shortly. |
Limits per account: 60 per minute, 1,000 per 24 hours.
Anything with a clear moment when a link is needed. When a post goes live in your blog or CMS, when a newsletter campaign is being prepared, or when a no-code tool such as Zapier or Make, or a Google Apps Script, processes a new row in your campaign sheet, one HTTP request returns a short address to hand to the next step.
Shorten the same original URL several times with different UTM values, such as utm_source=instagram and utm_source=newsletter, and My page lets you line up clicks and referrers link by link to see which channel really worked. UTM conventions are covered in how to add UTM parameters.
Send the original address as the url value to POST /api/v1/shorten. Both a JSON body ({"url": "https://..."}) and a regular form post are accepted, and you authenticate with the X-API-Key and X-API-Secret request headers. On success you get JSON containing short_url, code and target_url.
The API only makes auto-code links like tlnk.kr/Ab3d, so you cannot pick the code, and brand.tlnk.kr subdomain links have to be made on the website. If a destination fails the safety check you get a check_failed error with a reason code instead of a link, so it pays to handle that branch in your workflow.
After signing up for free and verifying your email, create a key on the API tab of My page. The public API Key starts with ak_ and the private API Secret with sk_, and up to 3 keys can be active at the same time. Splitting them by purpose (blog, newsletter, automation tool) means revoking one does not stop the other workflows.
The secret appears once, right after creation, and the server stores it in a form that cannot be reversed, so there is no way to look it up later. If it is lost, revoke that key and issue a new one. Keep it in your automation tool's secret variables or a server environment variable, never in browser JavaScript, a public repository or a shared template.
Yes; only the entry point differs. The domain must have been registered at least 1 month (30 days) ago and actually respond, it must not be on the KCSC block list or in URLhaus or OpenPhish, and it must be free of illegal-content keywords. Every forwarding hop is re-examined and internal network addresses are refused. After creation the link is rechecked every 3 hours and on each visit, and three separate reports block it automatically.
Each account has caps on links created per minute and per 24 hours and on requests handled concurrently. Sending many addresses that fail the check in a short span gets your requests refused for a while. When you hit a limit, the Retry-After value in the response says how long to wait, so set your automation to pause that long before retrying.
Accounts that mass-produce links in a short time are reviewed by the operator, and if the activity looks like spam or smishing, API access for that key or the whole account may be blocked. Operating principles are on the About tlnk.kr page.
Yes for members, within the per-minute and 24-hour creation limits.
No. The API only makes auto-code links. Names like brand.tlnk.kr (4–32 lowercase letters, digits or hyphens) are created on the website, where the certificate is issued automatically too.
Revoke that key under My page › API right away, issue a new one and update your workflow settings. Requests arriving with a revoked key are rejected at once.
They appear in your short URL list on My page next to links made on the website, with the same click, referrer, country and device stats, destination editing and pausing.
Yes. Like any other link, one with no clicks for 3 months (90 days) is deleted, and the address is not reused for 1 year.