Sprykit API

What the API covers

• QR codes, and only QR codes

  List, create, read, update and delete. Landing pages, link pages, business cards, analytics and domains are dashboard-only for now.

• Workspace API keys

  Each key belongs to one workspace and carries its own read, write and delete permissions. Send it as a bearer token or an X-API-Key header.

• OpenAPI 3.1

  The reference is generated from the route handlers themselves. The machine-readable spec is at /api-spec.json.

Quick start

1. 1

   Create an API key

   Go to Settings → API keys in your dashboard and grant the key the permissions it needs. The full key is shown once, at creation; afterwards the dashboard displays only its first eight and last four characters.

   Keys are the prefix qr_ followed by 32 random bytes in base64url — 43 characters. Masked, that reads:

   qr_a1B2...z9Y8
2. 2

   Make your first request

   name and content are required; content is whatever the code should encode. The response carries the created record under qrCode.

   curl -X POST https://app.sprykit.com/api/public/qr \
     -H "Authorization: Bearer qr_<YOUR_API_KEY>" \
     -H "Content-Type: application/json" \
     -d '{
       "name": "My first QR code",
       "content": "https://example.com"
     }'

3. 3

   Explore the reference

   Every endpoint, parameter and response shape, generated from the handlers.

   Open the full API reference

Code examples

const response = await fetch('https://app.sprykit.com/api/public/qr', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer qr_<YOUR_API_KEY>',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    name: 'My QR code',
    content: 'https://example.com',
    designSettings: {
      fgColor: '#2563EB',
      bgColor: '#FFFFFF',
    },
  }),
});

const data = await response.json();
console.log('QR code created:', data.qrCode.id);

import requests

response = requests.post(
    'https://app.sprykit.com/api/public/qr',
    headers={
        'Authorization': 'Bearer qr_<YOUR_API_KEY>',
        'Content-Type': 'application/json'
    },
    json={
        'name': 'My QR code',
        'content': 'https://example.com',
        'designSettings': {
            'fgColor': '#2563EB',
            'bgColor': '#FFFFFF'
        }
    }
)

data = response.json()
print(f"QR code created: {data['qrCode']['id']}")

<?php
$ch = curl_init('https://app.sprykit.com/api/public/qr');

curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    'Authorization: Bearer qr_<YOUR_API_KEY>',
    'Content-Type: application/json'
]);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode([
    'name' => 'My QR code',
    'content' => 'https://example.com',
    'designSettings' => [
        'fgColor' => '#2563EB',
        'bgColor' => '#FFFFFF'
    ]
]));

$response = curl_exec($ch);
$data = json_decode($response, true);
echo "QR code created: " . $data['qrCode']['id'];
?>

Endpoints

Six operations on one resource. Anything not listed here is not on the public API.

• GET/api/public/qrneeds read

  List the workspace’s QR codes. Takes limit, offset and active.

• POST/api/public/qrneeds write

  Create a QR code. Requires name and content; designSettings is optional.

• GET/api/public/qr/listneeds read

  An alias of the list endpoint above, with the same response.

• GET/api/public/qr/{id}needs read

  Read one QR code.

• PUT/api/public/qr/{id}needs write

  Update name, content, designSettings or active.

• DELETE/api/public/qr/{id}needs delete

  Delete a QR code permanently.

Authentication

Every public endpoint takes a workspace API key, either way round. A key with the wrong permission gets a 403 rather than a 401, so you can tell the two apart.

Rate limits

One sliding window, one hour long, counted per API key. Your workspace’s allowance is an entitlement rather than a fixed number per plan, so read it from the response instead of assuming it — a workspace with no API entitlement has an allowance of zero and every call answers 429.