DEVELOPERS

API reference

REST over HTTPS. JSON bodies. No SDK to install — just fetch.

The Honopu API covers the same operations as the dashboard. If you can do it in the UI, you can do it over HTTP. Use it to create codes from your own CMS, sync scans into your warehouse, or automate campaigns that would be tedious to manage by hand.

The API is available on Growth plans and above.

Authentication

Every request needs an API key. Generate one under Settings → API keys. Include it on every request as a bearer token.

curl

curl https://honopu.com/api/links \
  -H "Authorization: Bearer hp_live_your_key_here" \
  -H "Content-Type: application/json"

Treat keys like passwords

API keys carry full workspace access. Never commit them to git, never paste them in Slack, never expose them in client-side JavaScript. If you think a key is compromised, rotate it — old keys revoke immediately.

Endpoint overview

Method	Path	Description
POST	/api/links	Create a new smart link.
GET	/api/links	List links in the workspace with filtering + pagination.
PATCH	/api/links/{id}	Update a link — most commonly, change its destination URL.
POST	/api/qr-codes	Create a QR code tied to a link.
GET	/api/analytics/recent	Last 20 scans across the workspace.
GET	/api/analytics/{linkId}	Full analytics payload for a single link — by-day, by-city, by-device.

Example: create a link

Request

curl -X POST https://honopu.com/api/links \
  -H "Authorization: Bearer hp_live_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{
    "destinationUrl": "https://example.com/fall-menu",
    "title": "Fall Menu",
    "shortCode": "menu-fall"
  }'

Response

{
  "id": "lnk_8X3k9pLMw7",
  "shortCode": "menu-fall",
  "destinationUrl": "https://example.com/fall-menu",
  "title": "Fall Menu",
  "url": "https://honopu.com/r/menu-fall",
  "createdAt": "2026-04-24T14:12:03.441Z"
}

Rate limits

We rate-limit per API key. Default is 300 requests per minute. Responses include the usual headers so you can back off gracefully:

Response headers

X-RateLimit-Limit: 300
X-RateLimit-Remaining: 287
X-RateLimit-Reset: 1714054923

Hit the ceiling and you'll get a 429 Too Many Requests. Need higher limits? Email us — we're accommodating for real use cases.

Webhooks

Subscribe to workspace events to push scans into your own systems in real time. Configure endpoints in Settings → Webhooks.

scan.created event

{
  "event": "scan.created",
  "createdAt": "2026-04-24T14:12:03.441Z",
  "data": {
    "linkId": "lnk_8X3k9pLMw7",
    "shortCode": "menu-fall",
    "city": "Dallas",
    "region": "TX",
    "country": "US",
    "deviceType": "mobile"
  }
}

Signed payloads

Every webhook request includes an X-Honopu-Signature header — an HMAC-SHA256 of the request body using your webhook secret. Verify it before trusting the payload.