The QR Code Spot API

What you can do

• Make editable codes in bulk, each with its own name, folder and your own reference.
• Change where a code goes, for example when a campaign or a menu changes. Printed codes keep working.
• Pause and resume codes, or delete them.
• Read scan counts by day, phone type, country and how people arrived.

The API follows exactly the same rules as your dashboard: the same plan limits, the same unsafe-link check, and codes made through the API show up in My codes like any other.

Plans

If your plan changes to one without the API, your keys stop answering until it's back on Pro and Scale. Nothing is deleted, and every printed code keeps working (our guarantee). See all plans.

Keys

Make a key on the API keys page (signed in). Give it a name, like "Zapier", and choose Read and change codes or Read only. The key is shown once: copy it then. We only keep a scrambled copy that can check it.

Send it with every request in the Authorization header:

curl https://qrcodespot.com/api/v1/me \
  -H "Authorization: Bearer qcs_live_YOUR_KEY"

Keep keys on servers and in tools like Zapier or Make, never in a web page or an app people download: anyone with a key can change your codes. The API doesn't answer browsers on other websites. If a key might have leaked, revoke it on the keys page and make a new one.

The code object

{
  "id": "k7m2xq",
  "label": "Spring menu",
  "destination": "https://example.com/menu",
  "short_url": "https://qrsx.net/k7m2xq",
  "folder": "Bella Cafe",
  "status": "active",
  "locked": false,
  "type": "link",
  "external_id": "crm-1042",
  "created_at": "2026-11-01T14:03:00Z",
  "updated_at": "2026-11-01T14:03:00Z"
}

• id: the code's short id, the part after the slash in short_url. Put short_url in your QR code.
• status: active, paused (scans see a "paused for now" page) or disabled (switched off by us after an abuse report).
• locked: true when your plan no longer covers changing this code. It keeps working; its destination can't change.
• type: link, or service for a table or room of QR Service Requests (read only here, with no destination).
• external_id: your own reference, if you gave one.
• Times are UTC, in ISO 8601.

Endpoints

Base address: https://qrcodespot.com/api/v1. Send and receive JSON.

Make a code

curl https://qrcodespot.com/api/v1/codes \
  -H "Authorization: Bearer qcs_live_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"destination": "https://example.com/menu", "label": "Spring menu", "folder": "Bella Cafe", "external_id": "crm-1042"}'

Answers 201 with the code object. Only destination is needed. Names are up to 60 characters and folders up to 40.

Retries are safe with external_id. Tools like Zapier retry when a request is slow. If a code with the same external_id already exists, you get that code back with 200 instead of a second one (or a 409 if its destination is different). Use any reference of yours up to 100 characters, like a row id.

List codes

curl "https://qrcodespot.com/api/v1/codes?limit=50" \
  -H "Authorization: Bearer qcs_live_YOUR_KEY"

{ "data": [ { "id": "k7m2xq", ... } ], "has_more": true, "next_cursor": "eyJ0Ijo..." }

Add cursor= with next_cursor for the next page. Filters: limit (1 to 100, default 50), folder, status (active, paused, disabled) and created_after (a time, like 2026-11-01T00:00:00Z, for "new code" checks).

Change where a code goes

curl -X PATCH https://qrcodespot.com/api/v1/codes/k7m2xq \
  -H "Authorization: Bearer qcs_live_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"destination": "https://example.com/summer-menu"}'

Send any of destination, label and folder (null clears a name or folder). The answer is the code object plus "counted_as_edit": only a new destination counts as a change, the same as in the dashboard, where changes from the API and the dashboard share one monthly allowance.

Scan stats

curl "https://qrcodespot.com/api/v1/codes/k7m2xq/stats?days=30" \
  -H "Authorization: Bearer qcs_live_YOUR_KEY"

{
  "id": "k7m2xq",
  "window_days": 30,
  "total": 1284,
  "daily": [ { "date": "2026-10-03", "scans": 41 } ],
  "by_method": { "qr": 1201, "button": 70, "hybrid": 13 },
  "devices": [ { "label": "iPhone", "scans": 702 } ],
  "countries": [ { "code": "US", "scans": 911 } ]
}

Leave out days for your plan's whole window (all time on Pro and Scale, with window_days as null), or ask for 1 to 90 days. The numbers match your dashboard; link-preview bots aren't counted. Stats are refreshed every 5 minutes.

Errors

Every error looks the same, with a type your code can check and a message for people:

{
  "error": {
    "type": "plan_limit",
    "message": "Your Pro plan includes 300 editable codes (links and service-request locations together). You have 300.",
    "upgrade_url": "https://qrcodespot.com/upgrade"
  }
}

Limits

• 60 requests a minute per key, of which 30 can make changes, and 30 stats requests a minute.
• 200 new codes an hour per account.
• Your plan's editable codes and destination changes, the same as in the dashboard.

Need more? Email support@qrcodespot.com.

Zapier and Make

Ready-made Zapier and Make apps are on the way. Until then, both can call the API directly: use a "Webhooks" or "HTTP" step with your key in the Authorization header, and an external_id so retries never make extra codes.

Beta

The API is new. Version 1 won't change in ways that break your code; new fields may be added, so ignore ones you don't know. Tell us what you build, and what's missing: support@qrcodespot.com.