Endpoint reference

The call

Addresses in, a short link each out. It is the only endpoint a site key opens, and the only request the site script ever makes.

POSTmethod

https://montvo.com/api/v1/site/links

Authorizationrequired

Bearer pk_live_… — your site key, from the Developers screen. A secret key is refused here.

Content-Typeexpected

application/json

1curl -X POST https://montvo.com/api/v1/site/links \2  -H "Authorization: Bearer pk_live_9f2c4b8a" \3  -H "Content-Type: application/json" \4  -d '{5    "urls": [6      "https://example.com/download",7      "https://store.example.com/hoodie"8    ]9  }'

The request body

urlsrequiredstring[]

Between one and 50 web addresses. Anything in the list that is not a string, or is not an address we can shorten, is dropped quietly rather than failing the whole call — the answer tells you which ones survived.

Addresses are normalized and deduplicated before anything is created, so sending the same destination twice in one call, or written two different ways, produces one link.

The response

200, with one object: links, keyed by the address exactly as you sent it.

1{2  "links": {3    "https://example.com/download": "https://montvo.link/105010",4    "https://store.example.com/hoodie": "https://montvo.link/1gjybr"5  }6}

An address that could not be shortened is simply absent from links. Read it with a fallback to the original rather than assuming every key you sent comes back.

Errors

One shape for every failure, so a caller writes one branch rather than one per case:

1{2  "error": {3    "code": "too_many_urls",4    "message": "Send at most 50 addresses at a time."5  }6}

Every call, including the ones that failed, shows up in the request log on your Developers screen with its status and how long it took. The log keeps 7 days.

Rate limit

3,000 calls a minute, per site key. That ceiling is set by your traffic rather than by your code — a site key is called once by every visitor who lands on a page — so it is deliberately far above the secret key's, and it is counted separately. A busy afternoon is not supposed to look like an attack.

X-RateLimit-Limit

On every answer to a key we recognized — a 401 carries none of these. 3,000 for a site key.

X-RateLimit-Remaining

Calls left in the current minute.

Retry-After429 only

Seconds until the window resets.

Calling it from a browser

Any origin may call this endpoint. That is the point of a tag on somebody else's page, and the reason the site key is a different kind of key from the secret one: it opens nothing worth stealing.

• The answer carries Access-Control-Allow-Origin for the calling origin, and Vary: Origin.
• OPTIONS is answered with 204 and a 24-hour Access-Control-Max-Age, so the preflight costs a visitor one request rather than one per page.
• Authorization and Content-Type are the allowed headers; POST and OPTIONS the allowed methods.

Calling it from a server

A page rendered on a server has no anchors for a browser script to find, so the swap has to happen while the HTML is being built. Ask for the short links, then write them into the markup:

1const urls = [2  "https://example.com/download",3  "https://store.example.com/hoodie",4];5 6const res = await fetch("https://montvo.com/api/v1/site/links", {7  method: "POST",8  headers: {9    Authorization: `Bearer ${process.env.MONTVO_SITE_KEY}`,10    "Content-Type": "application/json",11  },12  body: JSON.stringify({ urls }),13});14 15// An address we could not shorten is simply absent from the16// answer, so fall back to the original rather than to undefined.17const { links } = await res.json();18const paid = (url) => links[url] ?? url;

Cache what comes back. A short link for a given destination does not change, and asking again on every render spends your rate limit on an answer you already have.