NOR Bit

The API.

Create short links from your own code, decode any NOR Bit link, and read your links’ clicks. Free, with a key you get here in one click. No account.

OpenAPI 3.1 (JSON) Endpoints

Get an API key

Up to 3 per connection per day. It is shown once. We keep only a fingerprint of it, so it can’t be shown again or recovered: store it somewhere safe, like your password manager or your server’s environment.

Getting a key means you accept the terms of use.

Quick start

export NORBIT_KEY=nbk_…

curl -X POST https://bit.normake.com/api/v1/links \
  -H "Authorization: Bearer $NORBIT_KEY" \
  -H 'Content-Type: application/json' \
  -d '{"url": "https://example.com/a/very/long/page"}'
Base URL
https://bit.normake.com/api/v1
Authentication
Authorization: Bearer nbk_… on every request except getting a key.
Your links are yours
Links you create belong to your key: only it sees their detailed statistics. Anyone can decode any link and see its total clicks.
Limits
100 new links and 1000 requests per key per hour; new links also count per connection, whatever key they use. 3 new keys per connection per day. Over a limit: 429 with Retry-After.
Errors
Always {"error": "code", "message": "…"}, with the usual HTTP status. Act on error; show message.
Keys are never deleted
DELETE /keys/current marks a key deleted: it stops working for good. The links it made keep working.
From a browser
CORS is open, so a page on any site can call the API. Anyone who can read that page can read your key, though: keep keys on servers.
Import it
openapi.json works in Postman, Insomnia, Swagger Editor and client generators.

Endpoints

Click one to see its parameters, examples and errors.

POST/keysGet an API keyno key

The key is in the response once: store it, it cannot be shown again. Up to 3 keys per connection per day.

No key needed.

Request body JSON

FieldTypeAbout
label optional string A name to remember the key by, such as newsletter script. Up to 80 characters; longer is cut. Shown back in GET /keys/current.

Example

{
  "label": "newsletter script"
}

Response 201

{
  "prefix": "nbk_Q2x9vT4a",
  "label": "newsletter script",
  "status": "active",
  "created_at": "2026-10-03T09:00:00Z",
  "last_used_at": null,
  "revoked_at": null,
  "links_created": 0,
  "limits": {
    "links_per_hour": 100,
    "requests_per_hour": 1000
  },
  "key": "nbk_Q2x9vT4a8YbN1cR6dE3fG7hJ0kL5mP9sU2wX4zA"
}

Errors: 429

curl

curl -X POST https://bit.normake.com/api/v1/keys \
  -H 'Content-Type: application/json' \
  -d '{"label": "my script"}'
GET/keys/currentThis key

Its status, limits, and how many links it has made.

Response 200

{
  "prefix": "nbk_Q2x9vT4a",
  "label": "newsletter script",
  "status": "active",
  "created_at": "2026-10-03T09:00:00Z",
  "last_used_at": "2026-10-03T09:15:00Z",
  "revoked_at": null,
  "links_created": 12,
  "limits": {
    "links_per_hour": 100,
    "requests_per_hour": 1000
  }
}

Errors: 401 429

curl

curl -X GET https://bit.normake.com/api/v1/keys/current \
  -H "Authorization: Bearer $NORBIT_KEY"
DELETE/keys/currentMark this key deleted

The key stops working immediately and cannot be restored. It is kept, marked deleted, never removed. Links it made keep redirecting and keep counting clicks; their manage links still work in a browser.

Response 200

{
  "prefix": "nbk_Q2x9vT4a",
  "label": "newsletter script",
  "status": "revoked",
  "created_at": "2026-10-03T09:00:00Z",
  "last_used_at": "2026-10-03T09:15:00Z",
  "revoked_at": "2026-10-04T08:00:00Z",
  "links_created": 12,
  "limits": {
    "links_per_hour": 100,
    "requests_per_hour": 1000
  }
}

Errors: 401 429

curl

curl -X DELETE https://bit.normake.com/api/v1/keys/current \
  -H "Authorization: Bearer $NORBIT_KEY"
GET/links/{code}/statsStatistics for one of your links

Clicks per day (QR scans included and also counted separately), and all-time clicks by referring site, country and device. Only for links your key made.

Link-preview bots (WhatsApp, Messenger, Slack, …) are never counted. Nothing identifies a visitor: no IP addresses are stored.

ParameterInAbout
code requiredpathThe part after /b/. Case-insensitive.
daysqueryHow many days of days to return. 0 is all time. One of 7, 30, 90, 365, 0.

Response 200

{
  "code": "k7x2m9q",
  "short_url": "https://normake.com/b/k7x2m9q",
  "target_url": "https://example.com/a/very/long/page?utm_source=newsletter&utm_medium=email",
  "status": "active",
  "created_at": "2026-10-03T09:15:00Z",
  "target_updated_at": null,
  "utm": {
    "source": "newsletter",
    "medium": "email"
  },
  "clicks": 42,
  "qr_scans": 17,
  "last_click_at": "2026-10-03T11:02:00Z",
  "owned": true,
  "decode_url": "https://bit.normake.com/d/k7x2m9q",
  "qr": {
    "svg": "https://bit.normake.com/b/k7x2m9q/qr.svg",
    "png": "https://bit.normake.com/b/k7x2m9q/qr.png"
  },
  "days": [
    {
      "day": "2026-10-02",
      "clicks": 30,
      "qr": 12
    },
    {
      "day": "2026-10-03",
      "clicks": 12,
      "qr": 5
    }
  ],
  "breakdown": {
    "referrer": [
      {
        "value": "facebook.com",
        "clicks": 25
      },
      {
        "value": "",
        "clicks": 17
      }
    ],
    "country": [
      {
        "value": "RO",
        "clicks": 38
      },
      {
        "value": "DE",
        "clicks": 4
      }
    ],
    "device": [
      {
        "value": "phone",
        "clicks": 35
      },
      {
        "value": "desktop",
        "clicks": 7
      }
    ]
  },
  "history": []
}

Errors: 400 401 403 404 429

curl

curl -X GET https://bit.normake.com/api/v1/links/k7x2m9q/stats?days=90 \
  -H "Authorization: Bearer $NORBIT_KEY"
GET/openapi.jsonThis descriptionno key

OpenAPI 3.1. Import it into Postman, Insomnia or a client generator.

No key needed.

Errors: none