# kealink

> Permanent link shortening and dynamic QR codes. A code we issue never stops resolving — including after the customer cancels. Codes get printed on physical objects, so a dead redirect is a reprint bill.

Base URL: `https://api.kealinks.com`

If you are an agent, you need two endpoints and nothing else on this site:

- `GET /api/openapi.json` — the full OpenAPI 3.1 document, generated from the running deployment's own schemas on every request
- `GET /api/pricing` — machine-readable prices and which payment protocols this deployment speaks

## Buying a link without an account

**Not enabled on `api.kealinks.com` yet.** Neither rail is configured, so `GET /api/pricing` returns `"protocols": []` and an unauthenticated `POST /api/links` returns `401`, not a `402`. Check `protocols` before attempting any of the below — an empty array means this deployment cannot take payment and you should stop.

`POST /api/links` with no credentials returns `402` carrying two payment challenges on one response:

- **MPP** in `WWW-Authenticate: Payment id=..., realm=..., method="stripe", intent="charge", request=<base64url JCS JSON>`. Retry with `Authorization: Payment <base64url JSON {challenge, payload:{spt}, source?}>`, echoing the challenge unmodified — its `id` is an HMAC over its own parameters. Success returns `Payment-Receipt`.
- **x402 v2** in `PAYMENT-REQUIRED: <base64 JSON>`. Retry with `PAYMENT-SIGNATURE: <base64 JSON>`. Success returns `PAYMENT-RESPONSE`.

Price: $2.00 one-time for one permanent link. The response includes `short_url` (the URL to print) and, exactly once for a new machine account, `api_key` — keep it or you can never repoint the code.

A payment credential is spendable exactly once; replaying returns `409`. Challenges expire after five minutes. Send `Authorization: Bearer klk_..., Payment ...` to credit an account you already hold a key for.

## Docs

- [Introduction](https://docs.kealinks.com/): what the product is and the two ways to use it
- [Quickstart](https://docs.kealinks.com/quickstart): create a link, download artwork, repoint it
- [Authentication](https://docs.kealinks.com/authentication): API keys, session tokens, workspaces
- [Paying as an agent](https://docs.kealinks.com/agent-payments): the full MPP and x402 flows
- [Permanence](https://docs.kealinks.com/permanence): why there is no delete, and how the guarantee is enforced structurally
- [Quarantine](https://docs.kealinks.com/quarantine): why every link starts at status 1 and why it does not restrict anything
- [Errors](https://docs.kealinks.com/errors): the single error shape and what 402 actually means

## Facts that surprise people

- **There is no delete endpoint.** `POST /api/links/{id}/archive` hides a link from the dashboard; the code keeps resolving. This is deliberate and permanent.
- **Archiving does not refund quota.** Every link is permanent, so an archived link still costs us forever.
- **`402` never means an existing link stopped working.** It means the requested action needs payment. Everything already created keeps resolving in every account state, including cancelled.
- **`status: 1` (quarantine) is normal, not a restriction.** Every link starts there; it resolves exactly like an active one, with a live safety check per resolution. Release takes three clean checks once the link is seven days old, and depends on nothing about the owner.
- **Editing a destination returns the link to quarantine** and resets its verification count. This stops the bank-clean-checks-then-swap evasion.
- **`404` does not distinguish "does not exist" from "is not yours".**
- **A machine account gets no free links on top of what it paid for.** The free tier's cost of entry is a verified email address, which a machine account has never had.