QRasli API

Create dynamic QR codes, edit destinations, render images and pull scan stats. Included in the Pro plan.

Authentication

Create a key in Dashboard → API keys and send it as a bearer token. Rate limit: 120 requests/minute per key.

Authorization: Bearer qrl_your_key_here

POST/api/v1/codes

Create a dynamic QR code. Returns the code with its short URL. Optional design object accepts the same fields as the designer (dotStyle, fg, bg, frameId, frameText…).

curl -X POST https://qrasli.asli.one/api/v1/codes \
    -H "Authorization: Bearer qrl_..." \
    -H "Content-Type: application/json" \
    -d '{"name": "Campaign A", "destination": "https://example.com/promo"}'

GET/api/v1/codes

List your dynamic codes (newest first, up to 100).

curl https://qrasli.asli.one/api/v1/codes -H "Authorization: Bearer qrl_..."

PATCH/api/v1/codes/:id

Update name, destination, or status (active | paused). Destination changes apply on the next scan. Also sets advanced rules: scanLimit, activeFrom / activeUntil (ISO datetime), activeHours ({start, end, tz}), password, expiredUrl, and routing ({ios, android, desktop, countries: {IN: url}, languages: {hi: url}}). Pass null to clear a rule.

curl -X PATCH https://qrasli.asli.one/api/v1/codes/CODE_ID \
    -H "Authorization: Bearer qrl_..." \
    -H "Content-Type: application/json" \
    -d '{"destination": "https://example.com/new-page", "scanLimit": 1000, "routing": {"ios": "https://apps.apple.com/app/x"}}'

GET/api/v1/codes/:id/stats?days=30

Scan totals, unique visitors (uniqueInRange) plus breakdowns by country, city, device, OS and browser.

curl "https://qrasli.asli.one/api/v1/codes/CODE_ID/stats?days=30" -H "Authorization: Bearer qrl_..."

POST/api/v1/render

Render any payload as a QR image. format: png (default, size 256–4096) or svg. Responds with the binary image.

curl -X POST https://qrasli.asli.one/api/v1/render \
    -H "Authorization: Bearer qrl_..." \
    -H "Content-Type: application/json" \
    -d '{"payload": "https://example.com", "format": "png", "size": 1024}' \
    -o qr.png

DELETE/api/v1/codes/:id

Delete a code. Printed copies will show a 'code removed' page (410).

curl -X DELETE https://qrasli.asli.one/api/v1/codes/CODE_ID -H "Authorization: Bearer qrl_..."

Webhooks

Instead of polling, let us call you. Add an endpoint in Dashboard → Webhooks and we POST JSON when a code is scanned (scan.created) or edited (code.updated).

Every request carries X-QRasli-Timestamp and X-QRasli-Signature, a hex HMAC-SHA256 of `${timestamp}.${rawBody}` using your signing secret. Compare it with a constant-time function and reject anything older than five minutes. Respond 2xx within 5 seconds; after 20 consecutive failures we disable the endpoint and tell you in the dashboard.

// Node/Express receiver
  const raw = req.body;                       // Buffer — verify BEFORE parsing
  const sig = req.header("X-QRasli-Signature");
  const ts  = req.header("X-QRasli-Timestamp");
  const mine = crypto.createHmac("sha256", process.env.QRASLI_SECRET)
                     .update(`${ts}.${raw}`).digest("hex");
  if (!crypto.timingSafeEqual(Buffer.from(mine), Buffer.from(sig))) return res.sendStatus(401);
  res.sendStatus(200);                        // ack fast, then do your work

Sample scan.created body:

{
    "event": "scan.created",
    "createdAt": "2026-08-07T09:14:22.000Z",
    "data": {
      "codeId": "clx…", "shortId": "a1b2c3",
      "scannedAt": "2026-08-07T09:14:22.000Z",
      "country": "IN", "city": "Bengaluru",
      "device": "mobile", "os": "Android", "browser": "Chrome",
      "referer": null
    }
  }

Ready to integrate?

Get your API key